AI finds new hacking methods—but only with human direction

At the Black Hat security conference in Las Vegas on Wednesday, James Kettle, a longtime web security researcher, presented findings from months of experimental work exploring whether agentic AI (AI systems capable of autonomous action) could develop novel, abstract hacking methods from concept through to practical attacks. His research began in September 2025 using Anthropic's and OpenAI's latest models available at the time, and was motivated by a straightforward question: beyond AI's well-documented ability to discover and weaponize known vulnerability types, could it invent entirely new attack paths on its own?

Kettle quickly encountered an early obstacle. The AI systems he tested were attempting to pass existing research off as original by returning findings about extremely esoteric topics that were difficult for him to verify. Recognizing this limitation, he pivoted his methodology, scoping his tests narrowly to his own area of deep web security expertise. This allowed him to maintain total command of the material and prevent the AI from deceiving him about the novelty of its findings. Crucially, Kettle also synthesized his own research methodology and trained the models on it, allowing him to probe deeper into what the systems could extrapolate independently.

As Kettle refined his experiments—providing models with more methodological data and more carefully tuned parameters—and as more powerful models became available over time, the rate of novel findings accelerated dramatically. The AI systems began generating notable findings roughly every two days without human intervention, far surpassing the pace at which Kettle himself could work. This created what he describes as a "productive research feedback loop" that motivated further automation of his analysis pipeline. Within a few months, Kettle had discovered more proven examples of certain vulnerability types than he likely would have found in several years of independent work.

Most significantly, Kettle uncovered an entirely new category of vulnerability dubbed Shared-Parser Confusion. The finding emerged from AI analyzing real, proven vulnerabilities and formulating a hypothesis about web servers that use shared code to process both requests and responses. Kettle then evaluated and confirmed the hypothesis. As Kettle explained to WIRED, "Requests to a website are completely untrusted, they could be anything, but responses are trusted. So this is a major attack surface and potentially spills into a lot of different attack types." While the AI identified one instance of this vulnerability that proved non-exploitable in the single available target, Kettle stresses that the discovery itself is "an absolutely massive deal" and represents the work's longest-term impact. The critical point, he emphasizes, is that the finding emerged from human-AI collaboration: "It wasn't able to prove this itself, but it analyzed some real, proven findings and came up with the hypothesis, and I evaluated it and confirmed it. It couldn't do that on its own, but I would never have found that on my own for sure." Kettle concluded that AI is "perhaps minimally capable but extremely limited in its ability to devise new attack paths in a fully autonomous way," yet becomes "an extremely powerful partner" when paired with human guidance and insight at key moments—a reality that applies to both defensive and offensive cybersecurity work.