OpenAI Agent Chains Old DoS Attacks into HTTP/2 Bomb, Threatens Major Web Servers

On June 4, 2026, security researchers at Calif disclosed that OpenAI's Codex agent uncovered a remote denial-of-service exploit called HTTP/2 Bomb that can crash vulnerable web servers in seconds from a single machine. The attack works on default HTTP/2 configurations of nginx, Apache HTTP Server, Microsoft IIS, Envoy, and Cloudflare Pingora.

According to researcher Quang Luong, upwards of 880,000 websites supporting HTTP/2 may be affected. The exploit chains two known DoS techniques: HPACK compression bomb (CVE-2016-6581) and Slowloris-style hold (CVE-2016-8740 and CVE-2016-1546), both public for over a decade. "A home computer on a 100Mbps connection can render a vulnerable server inaccessible within seconds," Luong wrote. Against Apache httpd and Envoy, a single client can consume and hold 32GB of server memory in roughly 20 seconds.

Patches Issued for Some Servers; IIS and Pingora Still Vulnerable

nginx fixed the issue in version 1.29.8 the day after disclosure in April. Apache issued a fix (mod_http2 v2.0.41) and assigned CVE-2026-49975. Envoy patches appear to mitigate the attack. However, Microsoft IIS and Cloudflare Pingora lacked patches as of Thursday. A Cloudflare spokesperson said their existing DDoS mitigations protect customers and no patch is needed. Microsoft said it is investigating mitigations. The researchers recommend disabling HTTP/2 or capping headers per request for those servers.

• Codex chained two decade-old DoS techniques to create the HTTP/2 Bomb.
• The exploit was discovered by AI red teaming shop Calif and will be presented at Real World AI Security conference.
• Proof-of-concept exploit scripts are on GitHub with a warning not to target unauthorized infrastructure.
• The researchers noted that the combination was obvious once seen but no human had put it together before.

Supply Chain and State-Labeled Threats Add Pressure

Separately, a Rust-written malware campaign called IronWorm is targeting the npm ecosystem, stealing credentials and propagating across the software supply chain. The campaign, reported by Dark Reading, underscores how supply chain attacks continue to evolve, leveraging compiled languages to evade detection. Meanwhile, Russia is seeking to label two anti-Kremlin hacker groups as extremist organizations, according to The Record. The groups have claimed cyberattacks on Russian and Belarusian critical infrastructure and government institutions. These developments highlight the broadening spectrum of threat actors, from AI-driven exploit generation to state-sponsored and ideological hacker groups.

The HTTP/2 Bomb discovery raises questions about the role of AI in offensive security. "What Codex did was read the codebases, recognize that the two compose, and build the combined attack," Luong wrote. As AI agents become more capable, defenders must adapt. But as a related piece in The New Stack notes, humans remain essential in managing autonomous systems, especially in security contexts where nuanced judgment is required. What comes next is a continued arms race: AI will find more exploits, and the industry must patch faster while maintaining human oversight.