Black Hat: A security researcher and AI together discovered a new class of web vulnerability that neither could find alone

A security researcher and an AI system have discovered what Kettle described as an entirely new class of web vulnerability called Shared-Parser Confusion, and neither could have found it without the other. James Kettle, Director of Research at PortSwigger, presented the finding at the Black Hat security conference in Las Vegas on August 5, 2026, revealing that AI systems independently generated new security research leads approximately every two days, surfacing more proven vulnerabilities in months than he could likely find in years of solo work 1. But the discovery Kettle said will probably have the biggest long-term impact, the Shared-Parser Confusion hypothesis, was proposed by the AI and proven by Kettle. Neither party could close the loop alone.

What Shared-Parser Confusion actually exposes

Most web servers draw a hard line between what comes in and what goes out. Incoming HTTP requests can contain anything: malformed headers, injection payloads, adversarial framing designed to trick the server. Outgoing responses are generated by the server itself, so the code that processes them assumes they are well-formed and trustworthy. Shared-Parser Confusion breaks that assumption. When the same parser handles both directions, a crafted request can exploit the parsing logic in a way that corrupts or manipulates the trusted response path 1.

Requests to a website are completely untrusted, Kettle told WIRED, but responses are trusted, so any parsing logic shared between the two creates a major attack surface that could spill into many different vulnerability types 1. The structural pattern it targets is not a bug in one product. It is an architectural assumption about trust boundaries baked into web servers broadly, and it went unnamed before this work.

Naming a vulnerability class gives both attackers and defenders a framework that did not exist when the flaw was hiding inside unnamed parser behavior.

Two blind spots that do not overlap

Kettle's system, called the HTTP Terminator, runs a four-phase pipeline modeled on his own research methodology: ideation (generating hypotheses), evaluation (testing them against live targets via authorized bug bounty programs), weaponization (building working exploits), and cascade (chaining findings into larger attacks) 2. He chose HTTP desync attacks as his test domain because it is his deepest area of expertise, having spent four years and delivered four major Black Hat and DEF CON presentations on the topic since repopularizing request smuggling in 2019 2. That expertise let him verify the AI was producing genuinely novel work rather than repackaging known research 1.

The experiments began in September 2025 using Anthropic's and OpenAI's latest models 1. The division of labor did not split into generation and approval. It split along a cognitive fault line:

• The AI generated notable research leads approximately every two days without human intervention, a rate Kettle described as producing genuine anxiety about falling behind 1.
• The AI found more proven vulnerabilities in a few months than Kettle could likely find in a few years of solo research 1.
• But the AI could not autonomously prove its most novel finding. It proposed Shared-Parser Confusion as a hypothesis after analyzing proven vulnerability data; Kettle confirmed it using expertise the model lacked 1.
• Kettle told WIRED that even if someone had handed him the specific line of documentation pointing to the vulnerability, he would not have recognized it on his own 1.

The throughput numbers quantify why this partnership matters. The AI's autonomous ideation rate of roughly one new research lead per two days annualizes to approximately 182 leads per year. Over Kettle's prior four years of HTTP desync research, he delivered four major conference presentations, a rate of roughly one per year 2. Those metrics measure different things, and that is precisely the point. The AI produces hypotheses at a rate no human can match. A researcher delivers proven, weaponized findings at a rate no AI can match. The bottleneck in this pipeline is not generation. It is verification. The AI surfaced 182 potential leads per year, but every single one required human evaluation to separate real discoveries from noise, and the most significant discovery of all required human expertise to prove at all.

What happens when the tool ships

Kettle plans to open-source the HTTP Terminator, making the research pipeline available to any team that wants to replicate it 2. For offensive security researchers, that is a methodology multiplier: encode your expertise into the system, let the AI generate hypotheses at machine speed, and deploy human judgment at the verification bottleneck.

For defenders, the calculus is less favorable. The discovery side now has a pipeline that generates 182 vulnerability hypotheses per year with a human to validate the important ones. The defense side has no equivalent system for evaluating whether its own infrastructure is vulnerable to an attack class that was publicly disclosed this week. Kettle built the HTTP Terminator to push fully autonomous research to its breaking point and find where human judgment remains irreplaceable 2. The answer, consistent across months of experiments, was the proof step. The pipeline can be replicated. The expertise to know which AI-generated hypothesis is real cannot.