What the 13% Looks Like: A Case Study

This piece analyzes James Kettle's 2025 research “HTTP/1.1 Must Die,” which introduced novel HTTP request smuggling/desynchronisation techniques (eg. Expect-header desync, 0.CL inversion, chunk-extension and browser-driven desync) that led to CVE-2025-32094 and CVE-2025-49005, produced substantial bounties, and enabled cache-poisoning at scale affecting roughly 24 million websites; it uses that case to argue AI tools reliably find documented issues but cannot discover frontier, unmapped techniques that require deep human systems expertise, and recommends funding human research alongside AI tooling.