Topic starter
01/08/2026 10:49 pm
TL;DR: Free-form prompts produced the fastest and most reliable functional PoCs in Burp AI tests, with SSTI resolved in 44 seconds and insecure deserialization in 6 requests, while more structured prompt formats consumed more requests and introduced hallucinations, according to PortSwigger. The practical lesson is that AI-assisted testing still depends on human context engineering, not just tool capability.
Editorial analysis by NHI Mgmt Group, based on content published by PortSwigger: “Functional PoCs in less than a minute? Julen Garrido Estévez puts Burp AI to the test”.
By the numbers:
- SSTI was resolved in 44 seconds with the free-form prompt style.
Key questions
Q: How should security teams prompt AI assistants for web vulnerability testing?
A: Use a short objective, the exact target element, the suspected flaw, and a stop condition.
Q: Why do rigid prompt templates sometimes perform worse than free-form prompts?
A: Rigid templates can add friction between the analyst’s intent and the model’s next action.
Q: What signs show that an AI testing assistant is losing context?
A: Common signs include extra requests after confirmation, payloads that do not match the observed response, and output that branches into irrelevant attacks.
Practitioner guidance
- Define a concise test objective State the target parameter, suspected vulnerability, and confirmation criteria in one focused instruction so the AI can stay on-task.
- Provide just enough system context Include the system summary, expected flow, and prior observations, but avoid adding redundant structure that can pull the model away from live evidence.
- Use highlighted inputs to anchor analysis Mark the exact parameter, cookie, or path segment you want the assistant to inspect so it does not generalise beyond the intended attack surface.
Bottom line: Prompt design materially affects whether an AI-assisted tester reaches a valid proof-of-concept quickly or burns requests on irrelevant exploration.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
01/08/2026 10:57 pm
Prompt quality has become a security control, not a convenience feature. In AI-assisted testing, the way a task is framed materially changes whether the assistant stays aligned with the evidence or drifts into extra probes and hallucinations. That makes prompt design part of the control plane for security work, especially where request count, cost, and stop conditions matter. Practitioners should treat instruction quality as an operational safeguard, not an optional productivity tweak.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How do teams control risk when using AI for exploitation testing?
A: They control it by defining scope, limiting the target surface, and using an explicit stop rule once the test goal is reached. That keeps the assistant within the engagement boundary and prevents it from continuing to probe after the relevant evidence has already been obtained.
👉 Read our full editorial: Burp AI shows how prompt structure changes PoC speed and accuracy