PortSwigger's HTTP Terminator: an autonomous agent that invented new HTTP desync techniques and used them on live banks and government sites
James Kettle published the HTTP Terminator whitepaper on August 5 (presented at Black Hat USA 2026 and DEF CON 34), answering whether an autonomous system can invent genuinely novel attack techniques rather than just find known bug classes. The architecture is the interesting part for agent builders: Turbo Intruder was equipped with an MCP interface and Python orchestration, and the exploitation agent's script was deliberately split so the LLM could not modify the deterministic segment that judges whether an attack succeeded — separating the actor from the verifier. It brainstormed sixteen response-queue-poisoning enhancement hypotheses and autonomously evaluated every one against every authorized bug-bounty target, yielding new desync triggers and gadgets that compromised banks, security products and government infrastructure.
↳ Follow the thread