HTTP Terminator: Human-AI Collaboration Uncovers New Flaw

A new AI system called HTTP Terminator has found hundreds of websites vulnerable to a critical security flaw. This system identified a new class of vulnerability, which it calls "shared-parser confusion." What's interesting is that HTTP Terminator didn't work alone. A human researcher guided the AI throughout the process. This human operator designed and built the AI, asked specific questions, and ruled out weak answers. The researcher also applied anomaly detection and restricted the AI's behavior. This collaboration allowed the system to generate, evaluate, and weaponize thousands of HTTP desync hypotheses. It uncovered a new technique that neither the AI nor its human operator would have found independently. A PortSwigger director of research explains that this shows an expert can significantly amplify an AI research system. It demonstrates that a human in the loop adds substantial value, beyond just creating the system. HTTP desync attacks, also known as HTTP request smuggling, interfere with how websites process requests. These attacks can allow an attacker to bypass security controls and gain unauthorized access to sensitive data. They can also compromise other application users. This research highlights the powerful potential of human-AI collaboration in cybersecurity.