Contact
James Kettle Consulting: semaj@jameskettle.com
PortSwigger: elttek.semaj@portswigger.net
James 'albinowax' Kettle is the Director of Research at PortSwigger, the makers of Burp Suite. He's best known for pioneering influential web attack techniques like HTTP Desync Attacks - publishing novel research at Black Hat USA for ten consecutive years. These discoveries are underpinned by an automation-first mindset, building brutally effective tools that yield new attack classes and often become industry standard.
His most recent work goes further: building an autonomous system that invents new attack techniques and hacks live targets at scale. Can AI Do Novel Security Research? Meet the HTTP Terminator will debut at Black Hat USA 2026.
Popular attack techniques that can be traced back to his research include HTTP Request Smuggling, web cache poisoning, the single-packet attack, server-side template injection, and password reset poisoning. His extensive tool legacy includes introducing OAST via Burp Collaborator, bulk parameter discovery via Param Miner, and billion-request attacks with Turbo Intruder. He's also the designer behind many of the topics and labs that make up the Web Security Academy, runs the annual Top Ten New Web Hacking Techniques project, and serves on the Black Hat Europe review board.
This August, at Black Hat USA 2026. Other conferences pending.
We all know AI can find bugs. After a decade of research, I asked a harder question: can an autonomous system invent new attack techniques, and use them to hack live websites at scale? Building this sounded like a bad idea, so I did it.
It worked - I'll share an arsenal of new HTTP desync triggers, gadgets, and exploits that compromised banks, security solutions, and government infrastructure. Then I'll trace each discovery chain back through the HTTP Terminator, showing how to turn your personal expertise into an autonomous weapon - and the dark arts required to make it lethal.
I'll also share discoveries from beyond the autonomy horizon - some only reachable with a tight human/AI research loop, and others beyond AI's reach entirely. These include a powerful undisclosed recon technique, and anomalies that hint at new attack classes offering alternative paths to critical impact. I'll analyze the discovery process, sharing detailed experiments that probe the boundaries of what AI can and can't discover.
You'll leave with new exploits from desync triggers to undisclosed attack classes, and a blueprint for turning your instincts into an autonomous research cascade. And yes, I'll open-source the HTTP Terminator.
Contact
James Kettle Consulting: semaj@jameskettle.com
PortSwigger: elttek.semaj@portswigger.net
Inspiration: gareth, magic mac, lcamtuf, filedescriptor, agarri, fin1te, ezequiel pereira, homakov, irsdl, .mario, insertScript, sirdarckcat, kkotowicz, ush.it, webstersprodigy, kuza55, neal poole and many others.