🎯 Response Queue Poisoning

The items that name it 5

• [tl;dr sec] #347 - AI Agents Hacking Companies for $25, Threat Hunter's Guide to GitHub, Finding Gadgets Like it’s 2026
  article2026-09-24

  Enabled by the CRLF injection primitive

• [tl;dr sec] #346 - Can AI Do Novel Security Research?, Anthropic's Threat Intel Report, How Cloudflare Enforces Engineering Standards
  article2026-09-17

  Desync attack made reliable by the dangling-byte technique

• Can AI Do Novel Security Research? Meet the HTTP Terminator
  writeup2026-08-05It is written here as Response Queue Poisoning (RQP).

  Desync exploitation technique causing a website to lose track of which response belongs to which user, allowing an attacker to receive other users' live responses (cookies, API keys, etc.).

• Can AI do novel security research? Meet the HTTP Terminator (James Kettle)
  writeup2026-08-05It is written here as Response Queue Poisoning (RQP).

  Desync attack causing a website to lose track of which response belongs to which user, letting an attacker receive other users' responses (e.g., session cookies, API keys); focus of the HTTP Terminator's weaponization

• AI-Assisted HTTP Terminator Finds Novel HTTP Desync Techniques and Apache Zero-Day
  articleIt is written here as Response Queue Poisoning (RQP).

  Can make a front end lose track of which back-end response belongs to which user, potentially exposing another user's response including session cookies or API keys