PPhyingไธญๆ–‡
Curated security research, vulnerabilities, advisories and tools for practitioners.

The future of security testing: harness AI-Powered Extensibility in Burp ๐Ÿš€

portswigger.net | blog | #ai-security | #pentesting | #burp-suite | #portswigger | #montoya-api | #extensibility | #hackvertor
๐Ÿ“„ Raw .mdโฌ‡๏ธ Download .md๐Ÿ”— Original โ†—

Summary

PortSwigger announced AI-powered extensions for Burp Suite Professional, built on the Montoya API. Interactions stay within PortSwigger's trust boundary, and Pro users get 10,000 free AI credits.
Published
Collected

Related coverage

blog · portswigger.net
Heading to San Francisco? Meet PortSwigger at OWASP Global AppSec USA 2026
Join us at booth G14 on 5โ€“6 November at the Hyatt Regency San Francisco. Weโ€™re a Gold sponsor, with live Burp AT demos, conversations about your AppSec programme, and something new to share. OWASP is
blog · portswigger.net
PHP2Shell x Burp Suite: Detection in your hands within a day of disclosure
PHP2Shell (CVE-2026-109618 and CVE-2026-109619) became the latest vulnerability to grab headlines around the globe. By some estimates, up to 70% of websites run at least some PHP. So if you're respons
blog · portswigger.net
How Burp AT helped expose whistleblower reports via a critical vulnerability that was overlooked for years
A customer story on how Burp AT, Burp Suite's agentic testing capability, helped Orange Cyberdefense analyst Ray Huygen work through 66,000 lines of minified JavaScript to find a critical access flaw that exposed confidential whistleblower reports, and turn the finding into a confirmed exploit.
blog · portswigger.net
Case study: How Burp AT helped expose whistleblower reports via a critical vulnerability that was overlooked for years
A case study of Burp AT analyzing 66,000 lines of minified JavaScript on a timeboxed engagement, uncovering a path to leak confidential whistleblower reports protected only by brute-forceable codes.
blog · portswigger.net
From capable AI models to trusted security testing
PortSwigger explains the thinking behind Burp AT: agentic capability is useful only when control sits outside the model, scope is enforceable, and agent activity is recorded as evidence.
blog · portswigger.net
Introducing Burp AT: agentic AI, built on two decades of Burp Suite
PortSwigger launches Burp AT (public beta) for Burp Suite Professional: agentic AI inside Burp using its tools, project context and pentesting skills, with user-defined autonomy.
Back