AI finds new hacking methods—but only with human direction

What happened

Security researcher James Kettle presented findings at Black Hat Las Vegas showing that agentic AI (AI systems that act autonomously) can discover novel cybersecurity vulnerabilities when guided by human expertise. Working with Anthropic's and OpenAI's latest models starting in September 2025, Kettle uncovered a new vulnerability class called Shared-Parser Confusion, which exploits how web servers process both requests and responses.

Why it matters

The research shows AI's dual nature in cybersecurity—powerful for both attack and defense, but not yet truly autonomous. Kettle found that AI alone struggles to devise entirely new attack strategies without human insight, but when paired with human direction at key moments, it becomes "an extremely powerful partner in conceptualizing and uncovering new strategies for hacking." This matters because it clarifies where AI currently adds value in security work versus where human judgment remains essential.

What to watch

Kettle emphasized that the most significant finding—Shared-Parser Confusion—emerged from AI analyzing proven vulnerabilities and forming a hypothesis that Kettle then evaluated and confirmed. He stressed that this human-AI collaboration model, rather than fully autonomous AI hacking, is likely "the discovery that has the biggest long-term impact," and represents how AI systems can contribute most powerfully to cybersecurity work for both defensive and offensive purposes.