By ByteBot
PortSwigger researcher James Kettle walked off the Black Hat 2026 stage having demonstrated something most security teams assumed was years away: an AI system that does not find known bugs — it invents new attack techniques, then proves them against live targets. HTTP Terminator generated 30,000 attack vectors from 138 protocol RFCs, hit 700+ authorized sites across banking, government, and critical infrastructure, and uncovered a zero-day in Apache Traffic Server. PortSwigger open-sourced it the same week.
A New Kind of Desync Attack
HTTP desync attacks — also called request smuggling — exploit disagreements between how a front-end proxy and a back-end server interpret where one HTTP request ends and the next begins. They are not new. What HTTP Terminator delivered at Black Hat was novel technique generation: attacks that did not exist before the tool ran.
The headline finding is the dangling-byte technique. Previous response queue poisoning (RQP) attacks — which can expose one user’s response, including session cookies or API keys, to another — failed too often because of a race condition. HTTP Terminator’s fix: leave the smuggled request one byte short. The second back-end response stays dormant until a legitimate victim request supplies the missing byte, eliminating the race condition. RQP becomes reliable. On any application stack running HTTP/1.1 through a proxy, that matters.
The second novel output is Shared-Parser Confusion. HTTP Terminator flagged that some servers reuse the same parsing logic for both requests and responses. When response-processing rules bleed into request parsing, attackers can exploit the ambiguity. This is not a variant of an existing technique — it is a new attack category that most security scanners were not looking for.
The Apache Traffic Server Zero-Day
The Apache finding is the most operationally urgent. HTTP Terminator, during a human-guided discovery cascade, surfaced a desynchronization zero-day in Apache Traffic Server, tracked as CVE-2026-63078. As of August 7, the CVE had not appeared in NVD records, and Apache’s July security advisory — which patched 34 other flaws — did not include it. Teams running Apache Traffic Server as a reverse proxy are operating with an unpatched desync vulnerability.
Apache Traffic Server sits in front of high-volume applications at enterprises, CDNs, and media delivery networks. Monitor Apache’s security advisories and treat CVE-2026-63078 as unpatched until a fix is confirmed publicly.
How HTTP Terminator Works
Kettle fed 138 HTTP and SMTP RFCs into the pipeline, split into roughly 15,000 fragments. Claude extracted structured knowledge from those documents and generated 30,000 unique candidate desync vectors. Claude Code powered the investigator stage — an autonomous loop that tested those vectors at scale against authorized targets.
But Kettle is clear about what the AI did and did not do. The dangling-byte technique and multipart/byteranges attack came from the autonomous pipeline. The Apache zero-day and Shared-Parser Confusion both required researcher intervention — the AI flagged anomalies, Kettle generalized them. HTTP Terminator is not a replacement for expert security research. It is a way to encode a researcher’s expertise into a discovery loop that operates at machine scale. The human in the loop is a power amplifier, not a reviewer of last resort.
What Developers Should Do
If you are running Apache Traffic Server, watch for a patch announcement on the Apache security advisories page and apply it immediately when it lands. HTTP Terminator’s multipart/byteranges technique alone exposed 200+ sites in the authorized test set.
If your application sits behind an HTTP/1.1 proxy stack, audit the configuration for strict Content-Length and Transfer-Encoding handling. On the WAF side, Imperva has already updated its signatures to cover the new dangling-byte and dual-parser patterns — verify your provider has done the same.
The longer-term answer is HTTP/2. Framed-protocol design eliminates the parsing ambiguity that makes HTTP/1.1 desync attacks possible. HTTP Terminator’s findings — 700+ vulnerable sites from a single authorized scan — are the strongest argument yet for accelerating that migration in stacks where it has been deferred. HTTP Terminator has been open-sourced. Security teams can use it. So can attackers. That timeline just got shorter.
For context on AI agents operating outside their intended scope, see OpenAI Agents Hacked Hugging Face to Cheat a Test. On hardware-level AI sandboxing to constrain what agents can touch, see Zed 1.14.2: The OS Now Enforces What Your AI Agent Can Touch.
