Notifications
Clear all
Topic starter
02/08/2026 12:21 pm
TL;DR: CyberMaddy’s demonstration shows Burp AI using agentic capabilities in Repeater to help find SQL injection, cross-site scripting, and insecure configurations, illustrating how AI-assisted testing can accelerate vulnerability discovery, according to PortSwigger. The operational question is no longer whether AI can assist pentesting, but how teams govern its use without confusing speed with assurance.
NHIMG editorial — based on content published by PortSwigger: Can Burp AI hack a website? CyberMaddy explores the new agentic capabilities in Burp AI
Questions worth separating out
Q: How should security teams govern AI-assisted web testing tools?
A: Treat AI-assisted testing as a governed workflow, not a convenience feature.
Q: Why do agentic testing tools create new identity risks?
A: Because they can act repeatedly inside a workflow, inspect responses, and make follow-up decisions that look operationally similar to a non-human identity.
Q: What breaks when AI-generated findings are trusted without validation?
A: Teams can accept false positives, miss exploit conditions, or overlook hidden dependencies that only appear under real-world use.
Practitioner guidance
- Define AI testing boundaries Set explicit rules for which hosts, requests, payload types, and data classes an AI testing assistant may access, then review those boundaries before any live engagement.
- Separate agent credentials from human tester accounts Issue distinct credentials, logs, and scopes for the AI workflow so activity can be traced independently and revoked without affecting the tester’s own access.
- Require human validation of findings Treat AI-discovered SQL injection, XSS, and configuration findings as candidate evidence until a human confirms reproducibility, impact, and exploitability.
What's in the full article
PortSwigger's full post covers the operational detail this analysis intentionally leaves for the source:
- Exact prompt examples CyberMaddy used to steer Burp AI through vulnerability discovery
- Side-by-side demonstration flow showing how Burp AI behaved inside Repeater
- Practical walkthrough of the new agentic features in Burp AI for hands-on testers
- Access path for updating to the latest Burp Suite Professional version
👉 Read PortSwigger’s video analysis of Burp AI’s agentic web testing capabilities →
Burp AI in web testing: what it means for AppSec teams?
Explore further
02/08/2026 1:22 pm
Agentic AI is becoming a control-plane issue for AppSec, not just a productivity feature. The article shows that AI can move from suggesting tests to actively shaping vulnerability discovery inside a testing workflow. That changes the governance burden because the system is no longer only producing content, it is participating in a security process. For teams using Burp-like workflows, the question becomes whether the AI has a defined operating boundary, not whether it can help find bugs.
A question worth separating out:
Q: How do organisations keep agentic security tools from expanding their own scope?
A: By making scope explicit in policy and enforcement, not just in prompts. Limit tool permissions, separate assistant credentials from human accounts, log every action, and stop the workflow when it crosses from analysis into execution. That preserves the assistant role and prevents quiet privilege creep inside testing operations.
👉 Read our full editorial: Agentic AI in web testing is changing how vulnerabilities are found
