Burp AT skills: how Port Swigger Research helps you get more from your agents | Port Swigger
Summary: PortSwigger Research has released Burp AT, a library of pentesting skills for agentic AI that is predominantly built from deterministic code, following the approach James Kettle described in his HTTP Terminator whitepaper. Skills are stored server-side and update automatically, and examples include Tom Stacey's CRLF-Powered Desync skill from his Black Hat USA and DEF CON research, Gareth Heyes's CSP bypass skill, and a skill for finding PHP2Shell-vulnerable instances released within a couple of hours of that disclosure.
Key Takeaway: PortSwigger says a skill must show a measurable improvement in agent benchmark results before it ships, and that it will retire skills as models improve - a maintenance burden that falls on your team if you run your own agent setup instead.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026