PortSwigger Evolves Burp Suite with Burp AT Agentic AI
PortSwigger is introducing Burp AT (Agentic Testing), a module for Burp Suite that transitions automated security testing from deterministic, rule-based scanning to autonomous, agentic workflows. By utilizing AI agents capable of interacting with existing Burp Suite tools—such as Proxy, Repeater, and Scanner—the system can execute complex, multi-step investigative tasks. This evolution addresses the need for advanced vulnerability research while implementing a critical "control layer" to manage risks associated with unconstrained agent behavior, specifically preventing scope creep, unauthorized actions, and destructive testing through mandatory human-in-the-loop validation and strict permission sets.
Darkmoon: Transitioning AI to Autonomous Active Directory Pentesting Agents
Darkmoon represents a strategic transition from stateless LLM-based chatbots to autonomous "agentic" systems designed for complex Active Directory (AD) exploitation. By implementing a recursive "Enumerate -> Reason -> Pivot" agent loop, the framework effectively overcomes the context window and statefulness limitations inherent in standard large language models. The system utilizes modular Markdown playbooks as state engines and a specialized State Proxy to maintain session context across multi-step, non-linear attack paths. This architecture enables autonomous discovery of privilege escalation routes and domain compromise via automated tool integration, providing an auditable and reproducible evidence trail for every stage of the exploit lifecycle.