PortSwigger introduces Burp AT for agentic AI security testing
PortSwigger has announced the public beta of Burp AT, a new addition to Burp Suite that brings agentic AI to professional penetration testing.
Burp AT enables penetration testers to delegate defined investigative tasks to AI agents that use Burp Suite’s tools, project context, and purpose-built pentesting capabilities. Testers control how much work the agents perform, while Burp Suite enforces scope, permissions, and approval rules. Responsibility for defining scope, exercising judgment, and validating findings remains with the penetration tester.
Models can now do more than run predefined checks. They can form hypotheses, act through tools, interpret how an application responds and decide what to try next. But using that capability professionally requires more than capable reasoning. Agents also need reliable execution, relevant engagement context, structured testing methodology and boundaries they cannot reinterpret or bypass.
“AI can already find vulnerabilities. The harder question is whether you can trust it against a real target. Burp AT gives the model room to reason, but Burp controls what it can actually do, executes the work through tools pentesters already rely on, and preserves the evidence. That is what turns agentic testing from an impressive demonstration into something useful on a real engagement,” said Dafydd Stuttard, Burp Suite creator and CEO of PortSwigger.
For pentesters already experimenting with coding agents and improvised agentic workflows, Burp AT provides a specialist alternative to assembling and maintaining integrations, prompts, context and controls around the testing workflow.
Built on Burp Suite
What agents can achieve depends heavily on the tools and context they work with. Burp AT enables agents to work natively through Burp Suite’s specialist web security tools, rather than relying on general-purpose HTTP libraries or improvised integrations.
Burp Suite’s tools reflect more than two decades of use against real applications. They reliably handle the malformed requests, message manipulation and protocol edge cases that professional web security testing often demands, allowing models to focus their effort on what to investigate and what to try next.
Agents can also draw selectively on relevant information already held in the Burp project, including traffic, target structure, issues and discoveries gathered throughout the engagement. They can add to that shared context as they work, enabling later investigations to continue from what is already known rather than beginning again from a blank prompt.
Purpose-built pentesting skills
Burp AT includes structured, task-specific pentesting skills developed with PortSwigger Research. These give agents reusable testing approaches without requiring every user to construct and maintain the methodology through prompts, scripts and workflow instructions.
The skills also create a route from research to repeatable testing. As PortSwigger Research develops and validates new techniques, those approaches can be translated into skills that agents can apply during real tests.
Autonomy on the pentester’s terms
Burp AT allows pentesters to choose how much work agents take on for each task and engagement. Actions can be allowed to proceed, configured to require approval or blocked. Smart approvals allow routine work to continue while escalating decisions that need the pentester’s attention.
Users can begin with tighter supervision and increase autonomy where agent performance, target sensitivity and engagement rules justify it. The existing Burp tools remain available whenever the pentester wants to take over directly.
Boundaries enforced by Burp
Scope, tool access and approval rules are enforced in Burp’s tooling layer, architecturally separate from the model. They are not instructions that the model is expected to remember or choose to follow.
Agents can propose actions, but cannot execute anything Burp does not permit. Agent requests and tool activity are recorded in the Burp project as testing progresses, giving pentesters a record they can inspect alongside the rest of the engagement rather than relying only on the model’s own account.