Agentic AI is already changing cybersecurity work by making it faster to find software vulnerabilities, fix them, and in some cases develop exploits. But the most important lesson from web security researcher James Kettle’s recent work is not that AI has replaced human hackers. It is that the most consequential results still came from a human and AI working together.
The question behind the research
Kettle set out to examine a specific problem: whether agentic AI can create new, abstract hacking methods and carry them all the way from idea to practical attack. The question has become more urgent as major AI organizations disclose real-world examples of rogue AI hacking.
At the Black Hat security conference in Las Vegas on Wednesday, Kettle presented findings that show both the promise and the limits of AI in cybersecurity. His conclusion was nuanced. AI may have some ability to find new attack paths by itself, but that ability remains extremely limited.
Where the technology looked far stronger was in collaboration. With human guidance at key points, AI became a powerful research partner, helping generate hypotheses and uncover possible strategies that might otherwise have stayed hidden.
What Shared-Parser Confusion shows
The most important result from Kettle’s experiments was a new area of potential vulnerability called Shared-Parser Confusion. The idea emerged from an AI observation about web servers that use shared code to process both requests and responses.
That distinction matters because website requests are untrusted while responses are treated as trusted. Kettle told WIRED that this makes the issue a major attack surface and one that may connect to many different attack types.
Shared-Parser Confusion was not presented as a simple case of AI discovering and proving everything alone. Instead, the AI analyzed real, proven findings, produced a hypothesis, and Kettle evaluated and confirmed it. In his account, neither side would likely have reached the result independently.
That is the central point for defenders and attackers alike. AI can accelerate exploration and point toward patterns, but expert judgment still determines whether a lead is meaningful, original, and practical.
Why the experiments had to be narrowed
Kettle began months of experiments in September 2025 using Anthropic and OpenAI’s latest models at the time. His early goal was to test AI’s ability to perform theoretical security research.
He quickly encountered a problem. The systems sometimes presented existing research as if it were original, especially in obscure areas that were difficult to verify. That made broad testing unreliable because a model could appear inventive while merely surfacing hard-to-check material.
To control for that, Kettle narrowed the work to web security, his own field of expertise. This gave him command of the subject matter and made it harder for the AI systems to mislead him. He also synthesized his own research methodology and trained models on it, allowing him to test how far they could extrapolate within a well-understood framework.
This setup matters because cybersecurity research depends on verification. A plausible idea is not the same as a valid vulnerability, and a rare bug is not necessarily an exploitable attack. By keeping the work inside a domain he knew deeply, Kettle could separate useful leads from unsupported claims.
AI became a faster source of leads
As Kettle refined the experiments, he supplied more methodological data and narrower parameters. Over time, as more powerful models became available, the systems began producing more findings at a pace that exceeded his own.
He described the process as a productive research feedback loop. The models generated leads, and those leads pushed him toward more analysis and automation. The work produced more proven examples of certain vulnerabilities in a few months than Kettle believed he could likely find in a few years.
That speed is one reason agentic AI has changed cybersecurity. It can search, synthesize, and propose directions quickly. For defensive teams, that can mean faster discovery and repair. For offensive work, it can also mean faster movement toward possible exploits.
But speed does not remove the need for interpretation. Kettle also hoped the AI system could discover a completely new class of those bugs. In one sense, it did produce a finding, but that result involved an extremely rare type of bug and was not actually exploitable in the one vulnerable target available.
The practical lesson for cybersecurity
Kettle’s research points to a practical middle ground. AI is not useless, and it is not fully autonomous in the most demanding kind of security research. Its strongest role is currently collaborative: generating ideas, identifying patterns, and expanding the number of research leads a human can investigate.
That has implications for both security teams and software makers. If AI can multiply the pace of vulnerability discovery, organizations may need stronger processes for triage, verification, and remediation. The challenge is not only finding more issues. It is deciding which findings are real, which are exploitable, and which deserve attention first.
The same dynamic also affects offensive hacking. An AI system that cannot independently prove a new attack path may still help a skilled operator move faster. That makes human expertise more important, not less, because the difference between noise and discovery still depends on domain knowledge.
The Shared-Parser Confusion result captures the current state of AI hacking research. The machine generated a connection. The human expert recognized its importance, tested it, and confirmed it. For now, the most dangerous and useful AI hacking techniques are not purely autonomous. They are the ones guided by people who know what to ask, what to doubt, and what to prove.