Managing access to Burp AT - Port Swigger
Summary: PortSwigger's documentation states that running Burp AT agentic tests requires the Use agentic testing site permission, which only the built-in Administrator role holds by default. Permissions accumulate across every group a user belongs to, and no role removes a permission another role grants, so access is withdrawn only by stripping that permission from every role in the user's groups or removing the user from those groups.
Key Takeaway: Because permissions stack and nothing subtracts them, a single group role carrying Use agentic testing lets a user create, stop and delete agentic tests on that group's sites - and an administrator turning Burp AT off, or a license expiring, halts running and queued tests instance-wide.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026