James Kettle wanted to find out if AI tools could go beyond finding new vulnerabilities and actually develop new attack techniques and exploits — so he built a Terminator.
An “HTTP Terminator,” to be exact. And as scary as the open source tool may sound, it worked — HTTP Terminator autonomously developed novel desync attacks, also known as HTTP request smuggling, that successfully hacked into real enterprise websites, including those of several financial services companies.
Kettle, director of research at PortSwigger, spoke with Dark Reading senior news director Rob Wright at the News Desk at Black Hat USA 2026 about how HTTP Terminator was developed, what it discovered, and how the tool will occasionally go off script.
“It deviates from instructions in every possible way,” Kettle said. “It is told to create vectors for request smuggling, and sometimes it will just decide to create vectors for cache poisoning instead.”
For all of our Dark Reading News Desk videos, please check out our YouTube channel, and our curated video articles.
Dark Reading News Desk With James Kettle: Full Transcript
Dark Reading’s Rob Wright: Hello and welcome to the Dark Reading News Desk at Black Hat USA 2026 in Las Vegas. I’m Rob Wright with Dark Reading, and I’m here with James Kettle of PortSwigger. James, how are you doing?
James Kettle: Pretty good, thanks.
DR’s Rob Wright: You had a session yesterday at Black Hat. Tell me a little bit about it. It sounded very interesting.
James Kettle: Sure. So my session was exploring whether AI can do genuinely novel, original security research, because we already know that AI can hack things. But no one was really exploring how far it can go, and they also, because many of them were kind of using it to market products, they weren’t saying where AI fails and where it runs into limitations and where humans actually add value to these systems as well. So I just wanted to take AI models to the absolute limit of their hacking capabilities.
DR’s Rob Wright: And what did you find?
James Kettle: I found it definitely can. I built something called the “HTTP Terminator,” which, once I built it, I was able to just hit go, and it autonomously invented a whole bunch of novel HTTP request-smuggling techniques, and used them to successfully exploit live websites, including multiple different banks.
DR’s Rob Wright: HTTP Terminator. It sounds menacing, but it was a success?
James Kettle: Yeah, it definitely was, but I also found that if I kind of stepped into the loop at one certain place in it, that made it significantly more powerful. Again, so AI can do novel security research fully or autonomously, but a human can act as a power amplifier for this system, and that’s how the best discoveries were achieved.
DR’s Rob Wright: OK, how long did it take you to construct this?
James Kettle: The initial working prototype only took a few weeks, but wasn’t very good. I would say I spent about six months working on this research overall. But, well, as you’ll see if you catch the white paper or the presentation, I kind of went off on a lot of kind of side quests and so on, on the way. And also, AI coding has improved a lot since I started this project. So there was one point I came super, super close after two months to just throwing the whole thing in the trash and rebuilding it from scratch because the code was so bad. But I just about didn’t do it and managed to get it working.
DR’s Rob Wright: OK. So it sounds like it took a lot of trial and tribulations and work to get to where you want.
James Kettle: Absolutely, but as part of the research, I’ve built a blueprint and I’ve open sourced the HTTP Terminator. So if someone else wants to do something similar, I’ve done everything I can to make their life easier.
DR’s Rob Wright: Now, is the Terminator specialized in finding any specific types of vulnerabilities or specific products or, like?
James Kettle: Yeah, absolutely. It’s pretty much fully focused on finding HTTP request smuggling.
DR’s Rob Wright: Just request vulnerabilities.
James Kettle: I focused on that because that’s an area that I’ve spent over four years researching myself. So I knew I could do a good job of building it to work well in that space. It does come up with other novel ideas, but it’s not fully autonomous because it can’t evaluate them. So a human is needed to evaluate those.
DR’s Rob Wright: Yeah, that was going to be my next question: Does the Terminator ever get restless and decide to maybe venture out and explore other avenues?
James Kettle: It definitely does. It deviates from instructions in every possible way. It is told to create vectors for request smuggling, and sometimes it will just decide to create vectors for cache poisoning instead. I only know that because one of their vectors was obviously intended to cause cache poisoning, but it actually caused request smuggling, so it got flagged as a successful finding.
It would also, when working on individual targets, sometimes it would get bored and just switch to a different unauthorized target, which was pretty terrifying the first time I saw it happen.
DR’s Rob Wright: Just switch.
James Kettle: Yeah, it would just kind of get bored and be like, “I don’t think this target is vulnerable,” and then be like, “Oh, but there’s a link to a different domain. I wonder if this technique works on that domain.”
DR’s Rob Wright: OK, this is scaring me a little because, I mean, after all, it is called the Terminator.
James Kettle: It wasn’t actually meant to be called the Terminator. It was meant to be called the “Desync Machine.”
DR’s Rob Wright: OK.
James Kettle: When I saw how dangerous it was becoming, I was like, “There’s only one thing to call it.”
DR’s Rob Wright: Yeah, there’s only one thing to call it. OK, so there is — well, there was a reason that was going to be my next question. Was there a reason that you named it the Terminator? Is it a reference to Skynet in the movie, or is it just, you know, sort of a play on words?
James Kettle: Yeah, it’s the feeling that I got as I was building it of, this thing is genuinely dangerous in its way. One of the key things it does is when it comes up with a novel technique and uses it to hack one website, it kind of analyzes how that worked and then uses that to inspire new techniques that it uses to hack other websites. So it gets this kind of feedback loop going, which is where a lot of the power comes from.
DR’s Rob Wright: Now you mentioned it was a little terrifying. Obviously, there’s been a lot of this in the news lately about models kind of freelancing, going rogue, escaping containment, doing whatever they kind of want, or not whatever they want, but fulfilling their goals in ways that maybe the designers did not intend. So, did you feel like there was a lot of pressure on you when you started to see this tool that you devised, that you created, kind of act in ways that was unexpected to you? Do you feel like, ‘Oh man, I better not screw this up?”
James Kettle: It was. I had some concern, but fundamentally, I think what saved me from anything like what’s been on the news is that the fully agentic components had a pretty strict budget, and then when the budget ran out, they just died. Yeah. So it was on a bit of a leash.
DR’s Rob Wright: OK.
James Kettle: And I think that meant they’re like, yeah, OK, it might occasionally go to a different target that it’s not supposed to, but it’s not really going to manage to hack that target, so …
DR’s Rob Wright: Interesting. OK, so, what have you learned since I guess you got it to a point where you’re like this is a working model, it’s a working tool, it’s able to do novel research. Have you thought about expanding the scope beyond?
James Kettle: Absolutely, it’s like the really obvious next step. I know exactly how I’d do it. And it’s probably what I’m going to do and present at Black Hat USA next year.
DR’s Rob Wright: Nice.
James Kettle: I think the key difference is going to be this time that quite a lot of the focus was on the AI and on the methodology, whereas I think by this time next year, it’s just going to be how everyone does research. So I’ll be talking more about the things it found and less about the actual system that did it, because it’s just going to be like, well, of course AI did the research.
DR’s Rob Wright: So there’s been a debate, especially over the past couple days here, about why AI is so good at hacking and sort of offensive action, not as good at defensive and, you know, sort of the blue team stuff. This kind of, to me, seems like it’s somewhere in the middle. I mean, it’s doing novel research, but it’s still fairly, to your point, a little dangerous because it could do something that is unintended, right?
James Kettle: Yeah, it’s not amazing at following instructions, I would say.
DR’s Rob Wright: But I mean, you can. It does seem like you can use this for obviously beneficial purposes for finding vulnerabilities. Have you thought about like using it to patch those vulnerabilities, or is that like a whole different ball game?
James Kettle: I think it will be a very different thing. I think fundamentally, this is about finding novel techniques, and then patching those techniques is, it’s a completely different thing. Like I built this thing by taking my own methodology, which I’d built up over years of testing, and giving it that exact methodology.
If someone else had a methodology for writing a quality patch? Yeah, I guess they could have a go, but it’s quite a different thing because it’s not really the original research if you’re just trying to fix a vector that someone else found.
DR’s Rob Wright: Yeah, interesting. Now, do you think the Terminator is going to get to a point where it is going to start, like, offering advice on how to fix this stuff? Like, once it finds a certain attack, you know, scenario or exploit or whatever, and it’ll start saying, “Hey, you should do this to correct it.” Or is that —
James Kettle: So? I don’t think it’s really necessary. Yeah. So this is exploiting request smuggling. I have a—I can tell you how to fix request smuggling. Don’t use upstream HTTP 1.1. HTTP 1.1 must die. Check out my presentation last year on that topic. If you use upstream HTTP/2 exclusively, then request smuggling is basically not an issue.
DR’s Rob Wright: Oh, OK.
James Kettle: So HTTP 1 is insecure. If you’re using it, you’re building your website on this insecure protocol. The solution is quite simple: just don’t use that protocol.
DR’s Rob Wright: OK, so why do we need AI to find this if it’s so simple to, I guess, identify?
James Kettle: So because people don’t want to use upstream HTTP/2 because there’s like an Internet-connected fridge out there that’s going to break when you switch on HTTP/2.
DR’s Rob Wright: Yeah. So people still do it.
James Kettle: Very, very common. Like many of the major vendors, like CloudFront, for example, don’t support upstream HTTP/2. You literally cannot use it, even if you want to, because they haven’t got round to supporting it yet. So, kind of one thing that I’m hoping to do with this sort of research is to put pressure on them to actually do that.
DR’s Rob Wright: Do you think that will happen? Are you optimistic about that or…
James Kettle: It’s definitely going to happen at some point in time. I like to think my research might speed it up slightly, but who knows, right?
DR’s Rob Wright: Well, we’ll be able to check back in with you, I guess, next year at Black Hat to see how far Terminator has grown, hopefully in a positive way, not a negative way, and to see how they’ve reacted to that. So, thanks, James. I appreciate it. This was an interesting discussion, and I hope the Terminator doesn’t freelance, and you keep it on a tight leash.
James Kettle: Yeah. Well, I’m really interested to see what other people do with it, now that it’s open source.
DR’s Rob Wright: Great.
James Kettle: I think interesting things may happen.
DR’s Rob Wright: Yeah, I expect so. Thanks so much, James. I appreciate it.
James Kettle: Thanks.
DR’s Rob Wright: And thank you for watching this segment of the Dark Reading News Desk. I’m Rob Wright, and we’ll see you next time.
