Learning with Burp AT
Summary: PortSwigger's Burp AT can now be used alongside Web Security Academy labs, with a /academy-lab-mentor skill that asks questions and offers small clues rather than the answer, drawing on the user's Proxy traffic and shared requests and responses. The skill's instructions tell Burp AT to keep the solution private but do not guarantee spoiler protection, and after a lab is completed it asks three open questions on why the vulnerability was possible, what evidence demonstrates it, and how the application could prevent it.
Key Takeaway: The tool's own documentation concedes that skill instructions guide behavior but do not enforce tool restrictions, so spoiler protection rests on the model's compliance rather than a control - a small but concrete example of the gap between prompting an AI agent and constraining it.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026