Burp AT enters public beta with the model outside the trust boundary.

PortSwigger opened Burp AT to Burp Suite Professional users on July 27. Scope, tool access, and approval rules live outside the model in a propose-enforce-decide loop, with every request and decision logged for reproducibility, plus a library of pentesting skills co-developed with PortSwigger Research replacing general model improvisation. One beta tester analyzed 66,000 lines of minified JavaScript in a four-day engagement and surfaced a critical vulnerability that would otherwise have gone untested for another year. Dafydd Stuttard: "Burp AT is new, and it has to earn that trust in the real world." (PortSwigger)