PortSwigger Launches Burp AT in Public Beta — Agents Propose, Burp Enforces, Humans Decide; One Beta Tester Read 66,000 Lines of Minified JS in Four Days
PortSwigger opened public beta of Burp AT to Burp Suite Professional users on Monday July 27, 2026, putting agentic AI inside a human-led pentesting workflow. The architectural choice matters more than the feature list: scope, tool access and approval rules live outside the model in a propose-enforce-decide loop, with every request and decision logged for reproducibility, and a library of pentesting skills co-developed with PortSwigger Research replacing general model improvisation. The concrete beta result cited is a tester who analyzed 66,000 lines of minified JavaScript during a four-day engagement and surfaced a critical vulnerability that would otherwise have gone untested for at least another year. Founder Dafydd Stuttard framed the beta explicitly as trust-earning: 'Burp AT is new, and it has to earn that trust in the real world.'
↳ Follow the thread