Burp AT: What's new since Black Hat
Summary: PortSwigger shipped a set of updates to Burp AT, its agentic testing tool launched at Black Hat USA, based on user feedback. The changes add custom user-defined skills selectable via a slash command, a /goal command that keeps the agent working toward an objective across multiple steps until it succeeds, decides it can't, or hits a limit, plus the ability to reject a tool call and redirect the agent, approve an action for the rest of a task, send requests and project issues into Burp AT, upload documents such as scoping documents and API specs, and queue prompts while a task is running.
Key Takeaway: The /goal command is aimed squarely at exploitation work - telling the agent to prove a hunch is exploitable and letting it grind through payload variations and WAF bypass attempts unattended, which shifts the constraint from analyst patience to how much autonomy you are willing to grant.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026