PortSwigger said its human-guided system, HTTP Terminator, generated, tested, and weaponized thousands of HTTP desynchronization hypotheses, found hundreds of sites vulnerable to request smuggling, and surfaced a new class it called shared-parser confusion. The work came from James Kettle and is framed as a research result, not a product patch.
The system kept producing plausible ways front-end and back-end servers could disagree about where one HTTP request ends and the next begins. By narrowing the ideas, rejecting weak ones, and using deterministic rules to steer the agent, the researcher turned ambiguity into cases where one request could be split or misread as another, which can poison responses or leak data across users.
For teams that rely on reverse proxies, load balancers, CDNs, or other shared HTTP paths, the useful shift is in how the risk is discovered: expert researchers with AI can expose parser-disagreement edge cases that ordinary scanning may miss. The exposure sits at the boundary between request parsers, not in any single box.