Topic starter
02/08/2026 12:21 pm
TL;DR: CyberMaddy’s demonstration shows Burp AI using agentic capabilities in Repeater to help find SQL injection, cross-site scripting, and insecure configurations, illustrating how AI-assisted testing can accelerate vulnerability discovery, according to PortSwigger. The operational question is no longer whether AI can assist pentesting, but how teams govern its use without confusing speed with assurance.
Editorial analysis by NHI Mgmt Group, based on content published by PortSwigger: “Can Burp AI hack a website? CyberMaddy explores the new agentic capabilities in Burp AI”.
Key questions
Q: How should security teams govern AI-assisted web testing tools?
A: Treat AI-assisted testing as a governed workflow, not a convenience feature.
Q: Why can agentic testing speed up discovery without improving assurance?
A: Agentic testing can surface more candidate issues faster because it accelerates search and reasoning, but assurance still depends on reproducible evidence, contextual validation and clear scoping.
Q: What are the signs that an AI pentesting system is producing unreliable findings?
A: Common warning signs include findings that lack concrete exploitation evidence, reports based only on weak surface indicators, and inconsistent results when the same test is repeated.
Practitioner guidance
- Define AI-assisted testing boundaries Specify which stages of web testing the AI may support, such as candidate discovery, request crafting or result summarisation, and require human validation before any issue is recorded as a finding.
- Preserve prompt and session evidence Store the exact prompts, request context and output history for every AI-assisted test so reviewers can reproduce the path that led to the finding.
- Separate exploration from verification Use AI to broaden search coverage, then require a deterministic manual check for exploitability, business impact and false-positive filtering.
Bottom line: Agentic AI in web testing can accelerate discovery of SQL injection, XSS and configuration weaknesses, but the underlying assurance model still depends on human validation.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:22 pm
Agentic AI changes the economics of AppSec before it changes the governance model. The immediate effect is faster discovery of candidate issues, not a fundamentally different security objective. That means teams will feel pressure to widen testing coverage while keeping the same review standards, and that tension will expose weak evidence handling. Practitioners should treat AI-assisted testing as a throughput change, not an assurance shortcut.
A question worth separating out:
Q: What should AppSec teams do when AI is used in bug bounty style testing?
A: Teams should set explicit rules for scope, supervision and evidence handling before using AI in bug bounty style testing. That means documenting the prompts used, confirming that humans still own the final judgment, and ensuring the workflow can withstand review if a result becomes a security ticket.
👉 Read our full editorial: Agentic AI in web testing is changing how vulnerabilities are found