PortSwigger Gives Security Agents Boundaries They Cannot Ignore
PortSwigger has launched Burp AT in public beta, allowing pentesters to use AI agents while enforcing scope, permissions and approval outside the model.
Giving an AI agent access to security-testing tools creates an obvious problem: the agent itself cannot be trusted to define where it is allowed to go. PortSwigger is putting that boundary outside the model.
What happened
PortSwigger launched Burp AT in public beta for Burp Suite Professional. Security testers can assign investigative tasks to AI agents inside the widely used web-security platform.
Burp separately enforces target scope, tool permissions, approval requirements and activity logging. This means the agent cannot expand its authority simply because a prompt tells it to. The surrounding software determines which systems and actions are available.
The design allows a tester to delegate repetitive investigation while retaining control over sensitive steps. It also creates a record of what the agent attempted and which actions were approved.
Why it matters
Penetration testing is a natural use case for agents because it involves searching, forming hypotheses and trying sequences of tools. It is also a high-risk environment: a mistaken action can affect systems outside the authorised test or disrupt a customer application.
Prompt-based instructions are not a sufficient security boundary. Models can misunderstand context or be manipulated by content they encounter. Enforcing permissions in the application layer is closer to the way mature software handles human users.
The bigger picture
This architecture could become a template for sensitive agent deployments beyond cybersecurity. Financial, healthcare and infrastructure agents may also need permissions that the model cannot override, explicit approval points and complete audit logs.
Burp AT remains a beta. Its effectiveness, false-positive rate and ability to handle complex targets have not been independently benchmarked. Human pentesters will still need to verify findings and judge business impact.
The interesting part is therefore not a claim that AI can replace security professionals. It is the control model. Agents may become useful in high-stakes work only when the product assumes they can make mistakes and gives them boundaries enforced by ordinary software.