Developing AI features in extensions - Port Swigger
Summary: PortSwigger published developer documentation for adding AI features to Burp Suite extensions through the Montoya API, covering AI availability checks, structured prompts built from system, user, and assistant messages, exception handling via the PromptException class, and temperature settings between 0 and 2. The docs state AI features are off by default and require the extension to override enhancedCapabilities() with the AI_FEATURES flag so users can select a Use AI checkbox, and they recommend lower temperatures for security-related tasks, with the default set to 0.5.
Key Takeaway: Extensions can now send prompts to an AI service from inside Burp Suite, and the documentation lists running out of AI credits and communication problems with the AI service as expected failure modes - so every extension you install that uses this API is another path by which scan data and user queries leave your environment.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026