Security researchers at PortSwigger report major progress in the ongoing effort to understand, reproduce, and defend against HTTP desynchronization attacks. At the center of the study is AI-Assisted HTTP Terminator, an AI-assisted research system created by James Kettle that explored an enormous space of possible request patterns and then validated what worked in practice.
According to PortSwigger, the system generated and proved new HTTP desync techniques after reviewing around 30,000 candidate attack vectors. In parallel, a human-guided discovery effort reportedly led to disclosure of a zero-day in Apache Traffic Server, later tracked as CVE-2026-63078 and patched.
What makes the work stand out is not only the results, but also the method: the team describes clear boundaries between what the autonomous system can uncover on its own and what still requires expert intervention to turn findings into confirmed vulnerabilities.
How AI-Assisted HTTP Terminator scaled HTTP research
The core of the project is an AI-assisted approach to exploring HTTP behaviors at scale. PortSwigger says HTTP Terminator was designed to generate candidate attack vectors, then prove which techniques can trigger desynchronization conditions on real targets.
To do that, Kettle fed the system a large set of standards references—138 HTTP and SMTP RFCs. Those references were broken down into roughly 15,000 smaller fragments, which then served as inspiration for the model to generate about 30,000 unique candidate vectors.
Importantly, the scanning activity was not indiscriminate. The researchers tested only websites where scanning was authorized through a bug bounty program or an approved vulnerability disclosure process. In the reported results, the researchers found roughly 700 vulnerable targets during the broad scan, followed by deeper validation steps and additional RQP-related research.
Novel desync triggers and the role of RQP
HTTP desynchronization attacks aim to cause different components in a request-processing chain to disagree about where one HTTP message ends and another begins. When that disagreement is exploited, an attacker can sometimes steer traffic so the front end associates one backend response with a different client than intended.
PortSwigger says the research produced new desync triggers, including a dual-matching Content-Length pattern. The team also highlights a technique they describe as “dangling-byte”, designed to make response queue poisoning (RQP) more reliable.
RQP is especially concerning because it can potentially cause a front end to lose track of which backend response belongs to which user. In the worst case, that could expose another user’s response content, including session cookies or API keys.
In practical terms, the dangling-byte technique works by leaving a smuggled request one byte short. The second backend response then waits until a victim request supplies the missing byte. This approach removes a timing issue that otherwise makes RQP unreliable across many sites.
From ideas to validation: what survived autonomous testing
PortSwigger reports that once the system generated multiple candidate improvements for RQP, it evaluated 16 distinct ideas aimed at strengthening the technique. Not all proposals worked as intended in follow-up validation.
According to Kettle, only the dangling-byte technique passed the evaluation criteria and remained viable after deeper testing. That result underscores the value of having both generation and proof in the same workflow, rather than relying on unverified hypotheses.
Where the vulnerable targets showed up
The findings were not limited to niche services. The researchers say the vulnerable targets included banks, government infrastructure, security products, and even an airport.
They also mention a specific example from their testing: a technique involving multipart/byteranges worked across multiple server implementations and exposed more than 200 websites in the test set, including an unnamed U.S. bank.
While the article does not name every affected organization, the breadth of the categories indicates that desynchronization issues can appear in many environments, especially where parsing and proxy behavior are complex.
Shared-Parser Confusion: a broader concept validated by Kettle
Beyond specific desync triggers, the research also focused on generalizing how these attacks can happen. PortSwigger says the system disclosed an attack concept called Shared-Parser Confusion, a broader idea that explains how response-processing rules can be misapplied to requests when servers reuse parsing logic.
Kettle states that the system proposed the concept, but he validated it and generalized it into a form that could be understood as a more systematic weakness pattern. He also emphasized that the discovery had an important division of labor: neither he nor the other researcher would have found it alone.
This distinction is described as part of the autonomy boundary in the study—some breakthroughs came from the system acting on its own, while other key steps required expert involvement to confirm and extend the findings.
Apache Traffic Server zero-day: what was disclosed and what’s unclear
In a separate human-guided discovery cascade, the researchers say a malformed request ultimately exposed a desynchronization zero-day in Apache Traffic Server. The issue was later patched and tracked as CVE-2026-63078.
However, the article also points out a verification gap. A check on August 7 did not find a public record for CVE-2026-63078 in CVE.org or the NVD, and an Apache advisory listing 34 flaws did not include it. Because of that, defenders currently lack a clear mapping from the CVE identifier to a specific fixed Traffic Server release.
In other words: while the patching is reported, the public reference trail may not yet allow organizations to confidently determine exactly which version to upgrade to in response to this particular CVE.
Defense guidance: removing HTTP/1.1 upstream, when possible
PortSwigger’s defensive recommendations remain focused on reducing the conditions that enable desynchronization. The team says defenders should avoid HTTP/1.1 upstream when possible.
When removing HTTP/1.1 upstream is not feasible, PortSwigger advises using controls on both layers: applying allow-listing strategies and restricting which HTTP methods are permitted to include request bodies.
These recommendations aim to eliminate ambiguity and reduce the chance that different components interpret the same traffic in incompatible ways.
Open-sourcing and supporting tools
PortSwigger has open-sourced HTTP Terminator, making parts of the approach available to the broader community. The paper does not list which specific model or version generated each autonomous discovery, but it describes how the released implementation works.
In the implementation described, Claude is used for document extraction and test-case generation, while an investigator stage requires Claude Code.
The researchers behind CRLF-powered desync attacks also released public tools for studying this class of vulnerabilities, including crlf-desyncs and crlf-powered-desync-scanner.
Why this research matters for defenders
The message for security teams is straightforward: HTTP request parsing and proxying can hide complex failure modes, and those failure modes can be hard to find with manual testing alone. By describing both large-scale candidate generation and targeted validation, the work suggests a path toward faster identification of new desync triggers.
At the same time, the reported results include real-world impact indicators—vulnerable targets spanning multiple sectors—so the techniques are not purely theoretical. For organizations, that reinforces the urgency of applying the recommended mitigations and keeping proxy and HTTP handling configurations under tight control.
Finally, the Apache Traffic Server disclosure highlights a practical challenge: even when a fix exists, public documentation may lag behind. Teams should monitor patch advisories, track CVE-related updates where available, and plan upgrades based on vendor guidance.
Conclusion
AI-Assisted HTTP Terminator illustrates how AI-assisted workflows can expand the search for HTTP desynchronization weaknesses. PortSwigger reports autonomous generation and proof of new techniques after exploring 30,000 candidate vectors, including RQP-hardening approaches like the dangling-byte method. Alongside that, the study also describes a patched Apache Traffic Server zero-day and validates a broader attack concept called Shared-Parser Confusion.
For defenders, the takeaway is to reduce parsing ambiguity, avoid HTTP/1.1 upstream where feasible, and implement layered allow-listing and request-body restrictions. Done well, these steps can significantly lower the likelihood that desync conditions evolve into data exposure.
Source: https://thehackernews.com/2026/08/ai-assisted-http-terminator-finds-novel.html
