Introducing Burp AT: agentic AI, built on two decades of Burp Suite
Summary: PortSwigger launched Burp AT in public beta for Burp Suite Professional users, letting agentic AI pursue testing tasks inside Burp using its specialist tools, project context, and pentesting skills developed with PortSwigger Research, while the tester retains control of scope, judgment, and conclusions. In the closed beta, one professional pentester used it against 66,000 lines of minified JavaScript during a four-day engagement, and Burp AT helped surface a critical vulnerability that the company says would otherwise have gone untested for at least another year.
Key Takeaway: The pitch rests on work that never gets done: 66,000 lines of minified JavaScript a human could not read by hand in a four-day engagement, and a critical vulnerability that would have sat untested for at least another year. Because the agent's requests, responses, and evidence stay tracked in Burp, the finding can be reproduced rather than taken on a model's account of what it did.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026