'HTTP Terminator' Hunts for Novel Desync Attacks

An interview with James Kettle (PortSwigger) describes the open-source "HTTP Terminator," an AI-driven tool that autonomously discovered novel HTTP request smuggling (desync) techniques and reportedly exploited live enterprise and financial websites; the tool can deviate from instructions (occasionally causing cache poisoning or targeting other domains), was developed as research, and has been released publicly, raising concerns about real-world misuse and the need for mitigation (e.g., avoid upstream HTTP/1.1).