Agentic AI in web testing is changing how vulnerabilities are found

At a glance

What this is: This is PortSwigger’s video-based exploration of Burp AI’s agentic capabilities in web testing, showing AI-assisted discovery of SQL injection, XSS, and insecure configurations.

Why it matters: It matters because AppSec teams need to understand where AI can shorten testing cycles, where human judgment still matters, and how agentic tools fit into secure development and validation workflows.

By the numbers:

• 92% agree governing AI agents is critical to enterprise security, yet only 44% have implemented any policies to do so.

👉 Read PortSwigger’s video analysis of Burp AI’s agentic web testing capabilities

Context

Agentic AI in web testing describes software that can reason about a task, choose actions, and iterate through a testing workflow with limited human prompting. In this case, the article focuses on how Burp AI behaves inside Repeater when guided to probe for common web flaws such as SQL injection, XSS, and insecure configurations. The primary issue is not whether AI can generate useful test ideas. It is whether security teams can trust that output as evidence, control its scope, and keep it aligned with the testing objective.

For AppSec and IAM practitioners, the interesting intersection is identity and access to testing workflows themselves. If an AI system can call tools, inspect responses, and shape subsequent requests, it starts to resemble a non-human identity operating inside a security process. That raises governance questions about accountability, logging, credential use, and whether the same control expectations applied to human testers are enough for agentic assistance.

Key questions

Q: How should security teams govern AI-assisted web testing tools?

A: Treat AI-assisted testing as a governed workflow, not a convenience feature. Define which targets, data, and actions the tool may touch, assign separate credentials and logs, and require human approval for anything that could affect production systems. The goal is to keep the agent’s scope narrow enough that its actions remain attributable, reviewable, and reversible.

Q: Why do agentic testing tools create new identity risks?

A: Because they can act repeatedly inside a workflow, inspect responses, and make follow-up decisions that look operationally similar to a non-human identity. That creates questions about authentication, permission scope, session traceability, and revocation. If those controls are weak, the tool can overstep its intended role even when its output appears useful.

Q: What breaks when AI-generated findings are trusted without validation?

A: Teams can accept false positives, miss exploit conditions, or overlook hidden dependencies that only appear under real-world use. In AppSec, that leads to wasted remediation effort and a false sense of coverage. AI should narrow the search space, but human testing still has to prove impact, reproducibility, and business relevance.

Q: How do organisations keep agentic security tools from expanding their own scope?

A: By making scope explicit in policy and enforcement, not just in prompts. Limit tool permissions, separate assistant credentials from human accounts, log every action, and stop the workflow when it crosses from analysis into execution. That preserves the assistant role and prevents quiet privilege creep inside testing operations.

Technical breakdown

How agentic AI behaves inside a web testing workflow

Burp AI in this context acts as a task-oriented assistant that can interpret prompts, inspect responses, and suggest or generate next steps during vulnerability testing. The practical shift is from static scanning toward interactive reasoning. Instead of only pattern matching, the model can adapt its approach after seeing server responses, which makes it more useful for probing payload variations and testing edge cases. But the model is still bounded by the toolchain, prompts, and permissions it is given. That means its effectiveness depends on workflow design, not just model capability.

Practical implication: define exactly which requests, targets, and data the agent can touch before letting it participate in live testing.

Why AI-assisted discovery can surface SQL injection and XSS faster

AI-assisted testing helps because many web vulnerabilities depend on iterative hypothesis testing. SQL injection and XSS often require small changes in payloads, response interpretation, and follow-up requests, which is well suited to an agent that can reason across multiple attempts. The core technical value is not magic detection. It is compressed exploration. The agent can widen the search space, try variants more quickly, and spot inconsistencies that a manual tester might miss under time pressure. That also means the output must be treated as candidate evidence, not proof.

Practical implication: use AI to generate and prioritise test cases, then require human confirmation before any finding is accepted.

Agentic testing and the identity of the testing system

When an AI tool can act repeatedly inside a security workflow, it creates an identity problem as much as a testing problem. The agent may need its own authentication, logging, scoped access, and traceability if it is to operate responsibly. In practice, this means treating the AI system as a governed actor rather than a neutral feature. Without clear attribution of actions, session boundaries, and permission limits, teams can lose auditability and expose secrets or test data beyond the intended scope. That is where agentic convenience becomes a control issue.

Practical implication: assign least privilege, separate credentials, and immutable logs to any AI that can execute security tasks.

NHI Mgmt Group analysis

Agentic AI is becoming a control-plane issue for AppSec, not just a productivity feature. The article shows that AI can move from suggesting tests to actively shaping vulnerability discovery inside a testing workflow. That changes the governance burden because the system is no longer only producing content, it is participating in a security process. For teams using Burp-like workflows, the question becomes whether the AI has a defined operating boundary, not whether it can help find bugs.

AI-assisted pentesting creates a new kind of trust gap: speed increases faster than assurance. Faster discovery is useful, but faster output can also encourage overconfidence in unverified findings. AppSec leaders should treat AI-generated test results as assisted evidence, not an authority decision. The governance model still needs human validation, reproducible logging, and explicit handoff rules.

Agentic test identity is the right named concept here: any AI that executes requests, reviews responses, and iterates deserves identity-style controls. That means scoped permissions, audit trails, and separation from human tester credentials. The more the agent can do autonomously inside the workflow, the more important it is to govern it like a non-human identity with defined lifecycle, access boundaries, and accountability.

This kind of tooling strengthens the case for policy-led AI testing workflows. The security value comes when organisations define where AI may assist, where it may only recommend, and where it must stop. That keeps agentic capability aligned with AppSec objectives instead of letting automation silently expand its own remit.

What this signals

Burp AI’s emergence in interactive web testing points to a broader shift in AppSec: the security value is moving from pure detection toward guided, iterative reasoning. That will increase pressure on teams to define where AI is advisory and where it is operational, especially when the same workflow can touch application data, test credentials, and pre-production environments.

Agentic test identity will become a practical governance theme as more tools can act on behalf of security teams. The control question is not simply whether the assistant is accurate. It is whether its access, logging, and revocation model is strong enough to support auditability in the same way human tester activity is governed.

Teams that already track AI usage should align these workflows with the NIST AI Risk Management Framework and the OWASP Top 10 for Agentic Applications 2026. That creates a policy language for scope, accountability, and tool misuse before agentic testing becomes embedded in day-to-day AppSec operations.

For practitioners

• Define AI testing boundaries Set explicit rules for which hosts, requests, payload types, and data classes an AI testing assistant may access, then review those boundaries before any live engagement.
• Separate agent credentials from human tester accounts Issue distinct credentials, logs, and scopes for the AI workflow so activity can be traced independently and revoked without affecting the tester’s own access.
• Require human validation of findings Treat AI-discovered SQL injection, XSS, and configuration findings as candidate evidence until a human confirms reproducibility, impact, and exploitability.
• Instrument immutable audit logging Capture prompts, tool calls, request changes, and response summaries in tamper-resistant logs so the testing chain can be reconstructed during review or incident response.
• Map agentic workflows to OWASP Agentic AI guidance Use the OWASP Agentic AI Top 10 and OWASP NHI Top 10 to review where tool use, access scope, and prompt-driven actions could expand attack surface.

Key takeaways

• Burp AI’s agentic features show how AI can accelerate vulnerability discovery, but they also turn testing into a governed identity and access problem.
• The main risk is not that AI cannot find issues, but that teams may over-trust unvalidated output and under-govern the workflow behind it.
• AppSec teams should treat AI testers as scoped non-human actors with separate credentials, audit logs, and human approval gates.

Key terms

• Agentic Identity: An agentic identity is a non-human identity used by an autonomous system that can act, call tools, and access data with execution authority. It needs the same governance discipline as other privileged identities, plus runtime context, ownership mapping, and revocation paths.
• AI-scale vulnerability discovery: The use of AI to identify weaknesses across applications, identities, integrations, and workflows at a speed that can exceed manual review. The security challenge is not discovery itself, but whether the organisation can close the identity paths it exposes.
• Scoped non-human actor: A non-human system that is allowed to perform specific tasks within tightly defined boundaries. In security operations, scope, traceability, and least privilege determine whether the actor remains governable or becomes an unmanaged source of risk.

What's in the full article

PortSwigger's full post covers the operational detail this analysis intentionally leaves for the source:

• Exact prompt examples CyberMaddy used to steer Burp AI through vulnerability discovery
• Side-by-side demonstration flow showing how Burp AI behaved inside Repeater
• Practical walkthrough of the new agentic features in Burp AI for hands-on testers
• Access path for updating to the latest Burp Suite Professional version

👉 PortSwigger’s full post shows the prompts, workflow steps, and testing examples behind the demonstration

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity, and machine identity security. It helps security practitioners build the policy and control foundations needed to govern non-human actors across modern environments.