Hacking with Burp AI in the Chesspocalypse: API expert Corey Ball showcases how Burp AI can support pentesters.
Summary: API expert Corey Ball's article "Hacking with Burp AI in the Chesspocalypse" describes testing PortSwigger's agentic AI assistant, Burp AI, on training targets as a digital sparring partner rather than an autopilot. In one example, when SQL injection attempts failed, Burp AI pivoted automatically to test for NoSQL injection and eventually uncovered a critical flaw exposing coupon data.
Bottom line: An assistant that pivots from a failed SQL injection attempt to NoSQL injection on its own changes how much of the testing loop runs without a human deciding the next move - and the flaw it found exposed coupon data.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026