PortSwigger is introducing Burp AT (Agentic Testing), a module for Burp Suite that transitions automated security testing from deterministic, rule-based scanning to autonomous, agentic workflows. By utilizing AI agents capable of interacting with existing Burp Suite tools—such as Proxy, Repeater, and Scanner—the system can execute complex, multi-step investigative tasks. This evolution addresses the need for advanced vulnerability research while implementing a critical "control layer" to manage risks associated with unconstrained agent behavior, specifically preventing scope creep, unauthorized actions, and destructive testing through mandatory human-in-the-loop validation and strict permission sets.

• Research/Tooling Overview: Transitioning to Agentic AI

  • Shift from traditional, rule-based automated scanning to autonomous "agentic" workflows.
  • Redefinition of the penetration tester from a manual task executor to a high-level orchestrator.
  • Integration of AI agents within a human-led framework to enhance investigative depth.

• Methodology/Discovery Scope: Agentic Integration and Context

  • Use of "Project Context" to provide localized data and environment awareness for AI decision-making.
  • Seamless orchestration of the Burp Suite toolset, including Proxy, Repeater, and Scanner.
  • Capability to execute defined, autonomous investigative tasks across complex target environments.

• Key Findings/Technical Highlights: The Control Layer and Toolset Synergy

  • Implementation of a dedicated "Control/Guardrail Layer" to enforce strict scope and permission sets.
  • Utilization of mandatory human-in-the-loop approval gates to mitigate destructive testing risks.
  • Deployment of Agentic AI Agents capable of sophisticated, multi-step vulnerability research.

• Industry/Defense Implications: Operational and Governance Shifts

  • Significant reduction in operational overhead for repetitive reconnaissance and enumeration tasks.
  • Enhanced security posture through the ability to perform deep, time-intensive vulnerability investigations.
  • Requirement for new security governance models to manage AI-driven offensive security operations.
  • Establishment of a new industry benchmark for professional, controlled agentic AI auditing.

• Conclusion: The New Standard for Professional Auditing

  • Represents a fundamental shift in the methodology of professional penetration testing.
  • Balances extreme investigative efficiency with essential, rigid safety guardrails.