AI turns 2024 theoretical HTTP/2 flaw into practical exploit hitting two-thirds of sites

Security researchers used large language models to generate and refine attack code targeting the HTTP/2 protocol's handling of header frames. The models rapidly iterated through edge cases that human teams had only sketched on paper the previous year, producing reliable denial-of-service payloads. Scans by security firms now show roughly 68 percent of surveyed web servers remain unpatched against this vector.

The original 2024 theoretical paper outlined the flaw but lacked concrete code; AI lowered the barrier by synthesizing working implementations in hours rather than weeks. This matches patterns seen in prior AI-assisted discoveries of memory-safety issues, where models accelerated exploit development without requiring deep domain expertise. The result compresses the usual disclosure-to-exploitation timeline from months to days.

Enterprise response has focused on rate-limiting and frame-validation patches already present in newer nginx and Apache releases. However, legacy cloud load balancers and embedded devices lag, creating a fragmented mitigation surface. Regulators in the EU and US are now considering mandatory timelines for protocol updates in critical infrastructure.

Next steps include coordinated vulnerability disclosure through CERT and expanded use of AI red-teaming to test remaining protocol implementations before similar acceleration occurs elsewhere.