PortSwigger launches Burp AT: agentic AI for professional pentesting in Burp Suite. KNUTSFORD, England, July 29, 2026 /PRNewswire/ - PortSwigger, makers of Burp Suite, today announced the public beta of Burp AT, a new product that brings agentic AI to professional pentesting in Burp Suite. Machine Learning & Artificial Intelligence Burp AT gives pentesters a new way to put agentic AI to work in Burp Suite. Agents can pursue defined investigative tasks using Burp Suite's tools, relevant context from the project and purpose-built pentesting skills. Pentesters decide how much work agents take on, while Burp enforces scope, permissions and approval rules. The pentester remains responsible for scope, judgment and conclusions. Models can now do more than run predefined checks. They can form hypotheses, act through tools, interpret how an application responds and decide what to try next. But using that capability professionally requires more than capable reasoning. Agents also need reliable execution, relevant engagement context, structured testing methodology and boundaries they cannot reinterpret or bypass. "AI can already find vulnerabilities. The harder question is whether you can trust it against a real target. Burp AT gives the model room to reason, but Burp controls what it can actually do, executes the work through tools pentesters already rely on, and preserves the evidence. That is what turns agentic testing from an impressive demonstration into something useful on a real engagement," said Dafydd Stuttard, Burp Suite creator and CEO of PortSwigger. For pentesters already experimenting with coding agents and improvised agentic workflows, Burp AT provides a specialist alternative to assembling and maintaining integrations, prompts, context and controls around the testing workflow. Built on Burp Suite What agents can achieve depends heavily on the tools and context they work with. Burp AT enables agents to work natively through Burp Suite's specialist web security tools, rather than relying on general-purpose HTTP libraries or improvised integrations. Business Operations Burp Suite's tools reflect more than two decades of use against real applications. They reliably handle the malformed requests, message manipulation and protocol edge cases that professional web security testing often demands, allowing models to focus their effort on what to investigate and what to try next. Agents can also draw selectively on relevant information already held in the Burp project, including traffic, target structure, issues and discoveries gathered throughout the engagement. They can add to that shared context as they work, enabling later investigations to continue from what is already known rather than beginning again from a blank prompt. Purpose-built pentesting skills Burp AT includes structured, task-specific pentesting skills developed with PortSwigger Research. These give agents reusable testing approaches without requiring every user to construct and maintain the methodology through prompts, scripts and workflow instructions. The skills also create a route from research to repeatable testing. As PortSwigger Research develops and validates new techniques, those approaches can be translated into skills that agents can apply during real tests. Discover more Autonomy on the pentester's terms Burp AT allows pentesters to choose how much work agents take on for each task and engagement. Actions can be allowed to proceed, configured to require approval or blocked. Smart approvals allow routine work to continue while escalating decisions that need the pentester's attention. Users can begin with tighter supervision and increase autonomy where agent performance, target sensitivity and engagement rules justify it. The existing Burp tools remain available whenever the pentester wants to take over directly. Boundaries enforced by Burp Scope, tool access and approval rules are enforced in Burp's tooling layer, architecturally separate from the model. They are not instructions that the model is expected to remember or choose to follow. Agents can propose actions, but cannot execute anything Burp does not permit. Agent requests and tool activity are recorded in the Burp project as testing progresses, giving pentesters a record they can inspect alongside the rest of the engagement rather than relying only on the model's own account. Available in public beta Burp AT is available now in public beta to Burp Suite Professional users. This first release puts Burp's agentic capabilities into the hands of professional pentesters on real engagements, where their feedback will shape how its tools, skills and workflows evolve. PortSwigger will expand the product throughout the beta while continuing to document its current capabilities and known limitations. To learn more about the current feature set, documentation and pricing, visit: https://portswigger.net/burp/burp-at About PortSwigger PortSwigger is on a mission to enable the world to secure the web. The company is behind Burp Suite, the industry-standard web security testing platform used by more than 90,000 security professionals and 18,000 organisations across 170+ countries. PortSwigger's products span practitioner-led testing and enterprise application security. Burp Suite Professional equips security professionals to investigate vulnerabilities in depth, while Burp Suite DAST helps more than 1,000 organisations automate security testing at scale. PortSwigger also works strategically with global enterprises including SAP, and combines its software with pioneering security research and free practical training to advance how the web is secured. SOURCE PortSwigger HiTechNectar send you the latest trends and best practice tips for online customer engagement: Receive Updates: HiTechNectar hate spams too, you can unsubscribe at any time.

PortSwigger launches Burp AT agentic AI for human-led web Penetration Testing. Spread the love July 28, 2026 PortSwigger has officially launched Burp AT in public beta, bringing agentic AI capabilities directly into Burp Suite Professional for the first time. The new feature allows penetration testers to delegate specific investigative tasks to AI agents while retaining full control over scope, judgment, and final conclusions, marking a significant shift in how professional web application security testing is conducted. The launch addresses a growing question in the security community: not whether AI can find and exploit vulnerabilities, since frontier models already demonstrate that capability, but whether such AI can be trusted for professional testing work where accountability and reliability matter. PortSwigger's answer is a system that combines Burp Suite's two-decade-old toolset with project-specific context and specialist pentesting skills developed alongside PortSwigger Research. PortSwigger launches Burp AT. Burp AT operates on four core pillars designed to make agentic testing viable in real engagements. First, agents work through Burp's established tooling rather than starting from scratch, drawing on existing project data like captured traffic, target structure, and prior findings. Second, a growing library of purpose-built pentesting skills gives agents structured methodologies instead of relying on general model knowledge, with new techniques added as PortSwigger's researchers develop them. Third, testers control autonomy levels, deciding what agents can execute independently, what requires approval, and what stays off-limits entirely. Fourth, and critically, all boundaries are enforced by Burp's tooling layer rather than the AI model itself, meaning every action is logged, and agents cannot bypass restrictions even if they propose them. This architecture reflects PortSwigger's core philosophy for the release: agents propose actions, Burp enforces limits, and the human tester decides. During closed beta testing, the practical impact became clear. One pentester used Burp AT to analyze 66,000 lines of minified JavaScript within a four-day engagement, a task impossible to complete manually in that timeframe. The agent reconstructed endpoints and workflows from the obfuscated code and flagged suspicious, unauthenticated areas for deeper investigation. This process surfaced a critical vulnerability that would likely have remained undetected for at least another year. The tester described the experience as transformative for both testing efficiency and skill development. Because all agent activity runs through Burp Suite itself, testers retain reproducible evidence, including requests and responses, rather than having to trust an AI's self-reported summary of its actions. This initial release represents what PortSwigger calls the first phase of a longer roadmap. Currently, Burp AT functions within a human-led workflow, augmenting individual testers' capacity rather than replacing their oversight. PortSwigger has indicated that future iterations will introduce additional operating modes suited to teams and enterprises, potentially including more autonomous testing under standing policies with shared visibility and audit trails, while human-led testing remains a permanent option. Speaking on the launch, PortSwigger Founder and CEO Dafydd Stuttard emphasized that trust must be earned rather than assumed. He noted that while Burp Suite has built credibility over more than 20 years of real-world use, Burp AT is new and must prove itself through the same process, which is why the company chose a public beta rather than a full release, inviting testers to stress-test the tool and shape its development. Burp AT is available now for all Burp Suite Professional users, offering a practical entry point for security professionals looking to integrate agentic AI into their existing testing workflows without ceding control over sensitive engagements. Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now. Portswigger has released its latest version of Burp Suite 2023.9.1, which includes a lot of additional features and bug fixes that can be helpful for security professionals and web application penetration testers. Burp Suite has been one of the most used Penetration Testing tools used by security professionals and organizations... August 12, 2023 In "Cybersecurity News - Original News Source is cybersecuritynews.com" Burp Suite 2023.10.3.4 was just published by PortSwigger and is aimed at ethical hackers and security experts with updated features. Burp Suite is a cybersecurity tool used for web application security testing. It is an intercepting proxy, allowing users to examine and manipulate the traffic between a web browser and... November 11, 2023 In "Cybersecurity News - Original News Source is cybersecuritynews.com" A new AI tool named HexStrike AI has been launched, designed to bridge the gap between large language models (LLMs) and practical cybersecurity operations. The latest release, v6.0, equips AI agents like OpenAI's GPT, Anthropic's Claude, and GitHub's Copilot with a formidable arsenal of over 150 professional security tools, enabling... August 15, 2025 In "Cybersecurity News - Original News Source is cybersecuritynews.com"

PortSwigger at Black Hat & DEF CON 33.