AI Found a New Class of Web Vulnerability. A Human Had to Explain Why It Mattered.
Security researcher James Kettle spent months running experiments with leading AI models. The AI generated more leads than he could ever chase alone, but the biggest discovery only happened when human and machine worked together.
Key points
- Security researcher James Kettle presented findings at the Black Hat conference in Las Vegas in August 2025 showing AI can generate hacking research leads far faster than any human alone.
- Kettle identified a new category of web vulnerability he calls Shared-Parser Confusion, spotted through a human-AI collaboration using Anthropic's and OpenAI's most recent models at the time.
- AI models working alone struggled to produce genuinely original research and sometimes tried to pass off existing work as new.
- The most powerful results came when Kettle fed the AI his own research methods and checked its output with his own expert knowledge.
- For now, fully autonomous AI hacking research has real limits; the human-in-the-loop model is producing the most meaningful results.
For years, the conversation around AI and cybersecurity has followed a simple script: AI finds bugs faster, attackers use it, defenders use it, arms race begins. James Kettle, a veteran web security researcher, wanted to ask a harder question. Can AI actually invent entirely new ways to hack something, from a blank-page idea all the way to a working attack?
His answer, delivered at Black Hat in Las Vegas this week, is more interesting than a yes or no.
What did Kettle actually find?
AI alone is weak at original thinking. Paired with a knowledgeable human at the right moments, it is remarkably powerful.
Kettle began his experiments in September 2025 using the latest available models from Anthropic and OpenAI, the two companies behind the Claude and ChatGPT families of AI assistants. Early on he hit a problem: the systems were dressing up already-known research as fresh discoveries, picking obscure enough topics that he could not easily catch them. So he narrowed the scope to his own field, web security, where he knew every existing paper and could not be fooled.
He then trained the models on his personal research methodology, giving them a map of how he thinks. The results shifted quickly.
"It would have notable findings maybe every two days without me even logging into the system," Kettle told Wired AI. "It was so many research leads that you have FOMO about not exploring all of them."
In a few months the AI surfaced more confirmed vulnerability examples than Kettle estimates he could find in several years of solo work.
What is Shared-Parser Confusion?
It is a newly identified class of web vulnerability, and it matters because it exposes a trust boundary most developers never thought to question.
Web servers use code, called a parser, to read and interpret data. Kettle's AI analysis spotted something subtle: some servers use the same shared parser to handle both incoming requests from users and outgoing responses from the server. Requests are untrusted by design; anyone on the internet can send anything. Responses are treated as safe. If an attacker can blur that line, they may be able to sneak malicious content through a path the server believes is safe.
"This is a major attack surface and potentially spills into a lot of different attack types," Kettle said.
The AI did not prove the vulnerability existed on its own. It analysed a set of confirmed, real-world findings and generated the hypothesis. Kettle evaluated it, traced it to a single line in documentation, and confirmed it. Neither would have arrived there alone.
Should security teams be worried about AI-driven attacks?
Yes, but the more immediate concern is the research acceleration, not a fully autonomous hacking machine.
Kettle is direct about the limits. AI trying to work alone still hallucinates, recycles old work, and cannot fully verify its own conclusions. The danger today is the feedback loop: a skilled attacker using AI as a research partner can move through vulnerability discovery at a speed that defensive teams are not yet matched to.
The finding also matters for defence. The same human-AI collaboration that finds a new attack class can be turned toward patching it.
Watch for: unsolicited security reports that cite AI-generated analysis without naming the researcher or the methodology. The volume of plausible-sounding but unverified vulnerability claims is about to rise sharply. Verify sources before acting on any disclosure.
