PortSwigger researcher James Kettle built a system called HTTP Terminator that took 138 HTTP and SMTP specification documents, broke them into roughly 15,000 fragments, and used those fragments as raw material to generate 30,000 candidate techniques for desynchronizing how front-end proxies and back-end servers interpret the same HTTP request, a class of bug that can make a server misattribute one user's response to a different user, potentially leaking session cookies or API keys between strangers sharing infrastructure. Run against roughly 30,000 real websites where testing was authorized through bug bounty programs, the system surfaced around 700 vulnerable targets, including banks, government systems, security products, and an airport, and one single technique alone affected the security posture of a US bank among 200-plus exposed sites. What makes this worth paying attention to beyond the raw numbers is the working model it demonstrates for combining AI with security research: the system operated autonomously to generate and validate new attack primitives, including a technique that fixes a known race-condition weakness in a class of attack called response queue poisoning by deliberately leaving a request one byte short until a victim's own traffic completes it. But the genuinely novel conceptual leap, recognizing that servers can misapply response-parsing rules to requests when they reuse the same parsing code, was proposed by the system but had to be validated and generalized by Kettle himself, and a separate zero-day in Apache Traffic Server came out of a human-guided investigation rather than the autonomous pipeline. That division of labor is the useful takeaway for builders: this generation of AI-assisted research tooling is genuinely productive at exhaustively generating and testing variations against a well-understood attack class, but the step of recognizing an entirely new category of bug still needed a human in the loop. PortSwigger has open-sourced the tool, which uses Claude for extraction and generation and Claude Code as its investigator stage, so teams can inspect exactly where the automation's judgment held up and where it did not.