PortSwigger Adds Burp AT, but Control Is the Real AI Pentesting Test

PortSwigger has put its first agentic pentesting system into public beta, pushing Burp Suite beyond AI assistance and into delegated security work. The Google News headline makes Burp AT sound like another AI product launch. The real change is more consequential: an agent can now operate established security tools inside a live Burp project.

Burp AT accepts a testing goal, selects actions, examines results, and adjusts its next step. Yet PortSwigger is not presenting unrestricted autonomy as the selling point. It is placing scope, permissions, and activity records outside the model's direct control.

That design creates the central tension. AI agents promise faster investigation, but penetration testing involves requests that can alter data, disrupt applications, or cross legal boundaries. PortSwigger is betting that professional adoption depends less on model intelligence than on enforceable limits and reproducible evidence.

The launch also puts pressure on standalone AI pentesting vendors and general-purpose coding agents. Those products can reason about vulnerabilities, but they do not automatically inherit Burp Suite's traffic history, testing tools, issue records, and existing practitioner workflow.

Burp AT Turns a Testing Goal Into Tool Actions

Burp AT changes Burp Suite from a collection of expert-operated tools into a workspace where a supervised agent can pursue an objective.

PortSwigger introduced Burp AT through the Early Adopter release of Burp Suite Professional 2026.7 on July 16, 2026. The company later expanded its public explanation and positioned the product as an agentic layer for human-led penetration testing.

An AI agent differs from a conventional assistant because it can plan and execute a sequence of actions. A chatbot might suggest a payload. An agent can select a tool, send the payload, inspect the response, revise its hypothesis, and continue testing.

According to the official Burp AT release, users start by describing a testing objective. The agent then works through Burp's existing tools while adapting to information returned by the target.

A task can focus on a broad area or a narrow suspicion. A tester might ask the agent to map an unfamiliar application, investigate an endpoint, reproduce a known issue, or check for a vulnerability class.

This is not background automation that silently scans everything. Burp AT starts only after a user opens it and provides a prompt. The user also defines the target scope and determines which tools require approval.

The system works inside the currently open Burp project. Users can attach an HTTP request, a site map node, or an existing issue as context. That detail gives the agent information already collected during manual work.

Burp AT also writes its activity back into the project. Requests appear in Burp's Logger, scans appear on the Dashboard, and reported vulnerabilities enter the familiar Issues workflow.

That shared context matters because security testing rarely begins from a clean prompt. A consultant may already have authenticated traffic, notes about application roles, suspected weaknesses, and partial evidence from earlier testing.

A separate agent would need those materials copied into a new environment. Burp AT can draw selectively from the project without requiring the tester to recreate the engagement history.

The agent also uses purpose-built testing skills developed with PortSwigger Research. These skills package focused techniques that the agent can apply during an assessment. PortSwigger says the library will expand as its researchers refine new methods.

However, the beta label deserves emphasis. PortSwigger calls this the first phase and advises testers to verify each finding before acting on it. The company has not published a broad, independent benchmark showing performance across varied production applications.

Google News coverage can make the release appear finished and broadly validated. The available evidence supports a narrower conclusion: PortSwigger has shipped a functioning agent inside Burp Suite Professional, with professional testing workflows shaping its design.

Why Existing Pentesting Workflows Are Under Pressure

The immediate pressure falls on security teams that still separate manual testing, automated scanning, and AI experimentation into disconnected systems.

Traditional dynamic application security testing sends predefined checks to a running application. It offers repeatability and coverage, but a scanner can struggle when a finding requires several context-dependent steps.

Human pentesters fill that gap. They form hypotheses, compare application behavior across roles, chain weaknesses, and decide whether an unusual response justifies a new line of investigation.

That judgment is valuable, but repetitive work consumes much of an engagement. Mapping endpoints, replaying requests, varying inputs, collecting evidence, and confirming known patterns can reduce the time available for deeper analysis.

General-purpose AI agents introduced another option. Testers can connect coding models to command-line tools, browser automation, or custom integrations. That approach offers flexibility, but it also transfers orchestration and safety work to the practitioner.

PortSwigger is trying to absorb that experimentation into a familiar environment. Its agentic testing model combines an AI planner with Burp tools, project context, reusable skills, and permission controls.

The strategic pressure extends beyond individual testers. Security consultancies must decide whether AI-assisted work changes engagement capacity, evidence requirements, or review procedures. Internal application security teams must decide which tasks can run repeatedly between formal assessments.

Standalone autonomous pentesting vendors face a different problem. They can promise independence from human workflows, but Burp already occupies the daily workspace of many web security practitioners. Integration can matter more than theoretical autonomy when buyers need adoption without replacing established processes.

General-purpose coding agents also face a credibility gap. They can write scripts and reason about code, yet a professional penetration test requires careful scoping, predictable tool behavior, and a defensible record of actions.

OpenAI's security agent illustrates the neighboring approach. Originally introduced as Aardvark and later incorporated into Codex Security, it analyzes source repositories, assesses exploitability, validates findings, and proposes patches.

OpenAI reported that its system identified 92 percent of known and synthetically introduced vulnerabilities in selected benchmark repositories. It also reported 10 open-source findings that received CVE identifiers. Those are company-reported results, not a direct comparison with Burp AT.

The products also operate from different starting points. The security research agent focuses on source code and development workflows. Burp AT interacts with a running web application through the tools and traffic inside a Burp project.

This distinction shows why the AI security market will not reduce to one universal agent. Source review, external attack-surface testing, web application testing, cloud validation, and remediation each require different context and controls.

The Google News framing focuses on PortSwigger adding an AI agent to its portfolio. The larger story is that security platforms now need an answer to delegated investigation, not merely generated explanations.

A conventional scanner follows programmed checks. A general agent can improvise but may lack specialist guardrails. Burp AT occupies the middle ground, using model reasoning while restricting execution through established tooling.

That combination pressures rivals to explain where their boundaries live. A promise that an agent is “safe” because its prompt says so will look weaker beside controls enforced by the surrounding application.

PortSwigger’s Advantage Is the Cage Around the Agent

Burp AT's most important mechanism is architectural separation between what the model proposes and what Burp permits.

Large language models produce probabilistic outputs, meaning the same context can lead to different responses. Penetration-testing tools usually need deterministic behavior, where a defined command produces a predictable operation.

PortSwigger combines those properties instead of asking the model to replace every testing component. The agent chooses among Burp tools, while the tools perform established operations.

The company says scope, tool access, and approval policies live in Burp's tooling layer. They are architecturally separate from the model, so the model cannot simply reinterpret a natural-language restriction.

This separation addresses a common agent problem. Instructions inside a prompt compete with other context, including content retrieved from an application. A malicious page can contain text designed to redirect an agent, a technique known as indirect prompt injection.

An external policy check does not make prompt injection irrelevant. It limits what a manipulated agent can execute. The agent might propose an improper action, but the tooling layer can reject that action when it violates scope or permissions.

Burp AT offers several levels of user control. A tester can require approval for individual actions, permit routine operations, or allow greater autonomy within configured boundaries.

Some actions remain sensitive regardless of convenience. Burp AT can send the same kinds of requests a human tester might send, including requests that change or delete data. That capability makes configuration part of the engagement's safety model.

PortSwigger states that high-impact actions require approval. Users can also disable particular tools, restrict scope, and stop a task while it is running.

There is an important exception. Custom scripts approved for execution can send network requests directly rather than passing through Burp's standard request tool. PortSwigger advises users to review such scripts and disable scripting tools when necessary.

That exception prevents an overly simple conclusion that every action is automatically contained. The safety boundary remains effective only when teams understand which tools bypass particular checks.

Logging forms the second part of the design. Burp records agent requests and tool activity in the project, while findings include supporting HTTP requests and responses.

This evidence lets a human reproduce the behavior and determine whether the reported issue is exploitable. It also creates a record for internal review, client reporting, and post-engagement analysis.

Reproducibility is essential because a plausible AI explanation is not proof of a vulnerability. A valid finding needs observable behavior, a defined attack path, and enough evidence for another tester to repeat it.

Project context provides the third mechanism. The agent can use selected traffic, issues, and site map data without uploading the entire Burp project.

This reduces rediscovery. If a tester has already authenticated, mapped a workflow, or isolated a suspicious request, the agent can begin from that point.

It also places responsibility on the user. Attached traffic can contain session tokens, personal information, source code, or customer data. More context can improve reasoning while increasing the sensitivity of what leaves the local system.

Burp AT's architecture therefore represents a tradeoff, not a complete solution. The agent gains usefulness by accessing real testing data and executing real tools. Those same capabilities create the need for strict scope, review, and data-governance decisions.

This is why the control layer matters more than a demonstration video. A clever exploit discovered in a lab proves capability. A permission model that survives routine professional use determines whether teams can deploy that capability responsibly.

Google News Attention Does Not Resolve the Data Risks

Burp AT keeps humans in control of actions, but customers still need to decide whether its data path fits their security and regulatory obligations.

PortSwigger documents that Burp AT and Burp AI use the company's AI infrastructure. A request travels from Burp to that infrastructure and then to an external model provider.

The company currently uses Anthropic models for Burp AT. Users cannot select a model or force processing into a specific geographic location.

PortSwigger says its infrastructure operates in AWS regions in Virginia and Ireland. The AI providers process requests in United States data centers, while routing between PortSwigger's regions happens automatically.

The system can transmit prompts, attached resources, agent messages, tool calls, and tool results. When a tool sends an HTTP request, those results can include full requests and responses.

Those materials often contain the most sensitive information in a penetration test. Authentication cookies, customer records, internal identifiers, API responses, and proprietary application logic may all appear in captured traffic.

PortSwigger states that Burp AT does not redact this material automatically. Users who need to inspect outgoing data can require approval before relevant actions, but that safeguard adds operational friction.

The company also stores prompts, responses, task details, and related metadata. Its data handling terms state that conversation and audit data are retained indefinitely for troubleshooting and long-term feature development.

Operational logs have a shorter stated retention period of 31 days. PortSwigger says stored data uses AES-256 encryption, while data in transit uses TLS 1.2 or later.

The company says its contracts prohibit model providers from retaining customer data or using it for training. PortSwigger nevertheless reserves the right to use anonymized data to improve its AI features and diagnose issues.

These terms are specific enough for security teams to evaluate, but they will not suit every engagement. Some customers prohibit external model processing, require regional data residency, or impose fixed deletion schedules.

A public beta also introduces technical uncertainty. PortSwigger says Burp AT uses deterministic tools, yet deterministic execution does not guarantee correct planning. The agent can still choose an unproductive path, misunderstand application logic, or stop before finding a relevant chain.

False positives are another risk. The system records evidence, but a human must determine whether that evidence supports the claimed impact. PortSwigger explicitly tells users to treat each finding as a lead requiring verification.

False negatives may be harder to detect. A polished task summary can imply completeness even when the agent overlooked an endpoint, misunderstood an authorization boundary, or abandoned a promising hypothesis.

Burp AT's current public materials do not establish how often such failures occur. PortSwigger has not released an independent evaluation across application architectures, vulnerability classes, and complex authenticated workflows.

That gap matters when comparing an agent with a human tester. Speed is measurable, but professional value also depends on coverage, novelty, accuracy, reproducibility, and sensitivity to business context.

An agent may efficiently identify a stored cross-site scripting flaw while missing that the affected page is isolated from meaningful users. It might also dismiss a low-severity authorization issue that becomes critical when chained with another weakness.

Human review is therefore not a ceremonial approval step. It supplies the business and threat context that HTTP responses alone may not reveal.

The dual-use nature of the technology adds another concern. An agent capable of finding and validating vulnerabilities can assist defenders, authorized researchers, or attackers. Product access, monitoring, and scope enforcement reduce misuse but cannot erase that underlying capability.

Google News visibility will increase curiosity among security teams and attackers alike. It should not be mistaken for validation that every organization can safely connect sensitive application traffic to the service.

The practical decision begins with engagement rules. Teams need to identify prohibited data, allowed targets, approval requirements, evidence standards, and retention obligations before assigning real work to the agent.

Burp AT Competes on Workflow, Not Maximum Autonomy

PortSwigger is choosing supervised integration over the claim that an AI agent can replace a professional pentester.

That choice distinguishes Burp AT from products marketed around end-to-end autonomous testing. Maximum autonomy is attractive because it promises broader coverage with less labor.

However, autonomy can become a liability when testing a production application. A system that acts without context may generate excessive traffic, modify customer data, or create a finding that nobody can reproduce.

Burp AT treats the human tester as the engagement owner. The agent handles delegated investigation, while the user establishes scope, controls permissions, reviews scripts, and validates results.

This model also preserves manual takeover. Burp's existing tools remain available, so a tester can interrupt the agent and continue an investigation directly.

The design reflects how experienced practitioners already work with junior team members. A senior tester can delegate a bounded task, review the evidence, redirect the investigation, and retain responsibility for the final conclusion.

An AI agent does not have professional accountability, however. It cannot understand contractual obligations in the same way as the consultant who signed the rules of engagement. Tool-enforced restrictions must translate those obligations into executable policy.

Standalone vendors can still compete by supporting broader attack surfaces, continuous testing, or automated remediation. Burp AT's initial focus is web penetration testing inside Burp Suite Professional.

Source-oriented agents also occupy a separate lane. They can analyze code before deployment and recommend patches, while Burp AT observes a running application's external behavior.

Automated scanners remain relevant as well. They offer predictable scheduled coverage and can run established checks across many targets without open-ended agent reasoning.

The emerging competition is therefore between operating models:

• Traditional scanners emphasize repeatability, scale, and predefined checks.

• General-purpose agents emphasize flexibility but require users to assemble tools, context, and controls.

• Autonomous pentesting platforms emphasize delegated coverage across defined environments.

• Burp AT emphasizes human-led investigation inside an established web-testing workspace.

None of these models eliminates the others. A mature application security program can use source analysis during development, automated scanning in delivery pipelines, continuous validation after deployment, and focused human testing for complex risks.

PortSwigger's advantage appears when a human tester already works in Burp. The agent can reuse that project's traffic, tools, findings, and workflow instead of creating a separate system of record.

Its disadvantage appears when buyers want unattended testing across many assets. The current positioning and public beta emphasize interactive, human-led work rather than a fully independent testing service.

The company's broader Burp AI features further clarify the distinction. Burp AI assists within particular tools, while Burp AT pursues a goal through multiple steps.

That portfolio gives PortSwigger a path from narrow assistance to supervised delegation. Customers can adopt individual AI features without immediately granting an agent broader access.

The company still needs evidence that this progression improves outcomes. User adoption will depend on whether testers save meaningful time without spending that time reviewing weak findings or managing approvals.

Teams should measure completed investigations, verified vulnerabilities, review time, duplicated work, and agent-caused interruptions. Counting prompts or generated findings would reward activity rather than security value.

The Google News story is therefore not simply PortSwigger versus another vendor. The primary contest is supervised autonomy versus unrestricted delegation.

PortSwigger has made its choice clear. The agent can plan, but Burp controls execution. The agent can report, but the tester must verify. The agent can use project context, but the organization must decide which context can leave the machine.

What Security Teams Should Watch Next

Three signals will determine whether Burp AT becomes a standard testing partner or remains an interesting beta feature.

The first signal is independent performance evidence. PortSwigger needs evaluations that separate vulnerability recall, false positives, testing time, and human review effort.

A useful comparison would examine the same scoped applications under manual testing, conventional scanning, and Burp AT-assisted testing. It should include authenticated workflows and business-logic flaws, not only known injection patterns.

Evidence of novel discovery would strengthen PortSwigger's case. The company connected Burp AT's launch with research presented around Black Hat USA 2026, where AI-driven security research attracted significant attention.

The Black Hat program confirms how central AI security became to the 2026 event. Conference demonstrations still need translation into repeatable customer results.

If independent testing shows higher verified coverage without a proportional review burden, supervised agents will gain credibility. If results depend heavily on curated targets, the beta will remain an assistant rather than a testing multiplier.

The second signal is enterprise control over data. Buyers will watch for configurable retention, regional processing choices, redaction, model selection, and stronger administrative policy.

These features would not make the agent more intelligent. They would make it deployable under a wider range of contracts and regulatory obligations.

A shorter or customer-controlled retention option would address one clear objection. Local processing or approved private models would open engagements that currently prohibit external AI services.

PortSwigger may also need centralized policy templates. Security consultancies should be able to define common tool permissions and evidence requirements across testers without configuring every project manually.

If the company expands these controls, its “agent inside a cage” strategy becomes more convincing. If governance stays fixed, adoption may concentrate among smaller teams and less restricted assessments.

The third signal is practitioner behavior. PortSwigger should reveal whether testers assign substantial investigative tasks or use Burp AT mainly for narrow, repetitive checks.

Frequent manual takeover would not automatically mean failure. It could show that the system works best as a collaborator that accelerates preparation while leaving difficult reasoning to humans.

The more important measure is verified output per unit of reviewer time. An agent that produces many findings but requires extensive cleanup can worsen a team's workload.

Practitioners should also monitor the skills library. New skills can turn research techniques into reusable testing procedures, creating a path from specialist discovery to wider application.

That path carries quality risks. A technique that works reliably in a research environment can behave differently across production architectures. Skills need versioning, testing, and clear evidence requirements.

For security leaders, the sensible next step is a bounded evaluation. Choose an authorized nonproduction target, restrict the toolset, require approvals, and compare the results with an existing assessment.

Keep the agent's findings, supporting traffic, reviewer decisions, and missed issues in a searchable engineering knowledge base. That record makes later comparisons more useful than impressions from a single demonstration.

PortSwigger has already answered one question: agentic AI now belongs inside a mainstream professional pentesting tool. The unanswered question is whether its controls can make delegated testing consistently trustworthy.

Ignore the excitement generated by a Google News headline and watch the evidence. Does Burp AT find verified issues faster, stay within scope, protect sensitive data, and reduce repetitive work?

If it does, the human pentester will not disappear. The role will shift toward defining objectives, supervising risky actions, interpreting business impact, and deciding when the agent's evidence is strong enough to trust.