# PortSwigger Blog Articles and product insights from the PortSwigger team. Keep up to date with Burp Suite and the world of web security by visiting our blog. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Can AI invent new attack techniques? New research from James Kettle and PortSwigger Research DevFeed: [Can AI invent new attack techniques? New research from James Kettle and PortSwigger Research]() Original publisher: [Read original article]() Author: Kieron Hughes Published: 2026-08-12T09:04:45Z Content type: article Language: en Sources: [PortSwigger Blog]() Topics: [AI research agents](), [Vulnerabilities]() Tags: [ai](), [attacks](), [autonomous](), [bug-bounty](), [http](), [open-source](), [research](), [vulnerabilities]() ### AI overview PortSwigger Research describes the HTTP Terminator, an autonomous system used to generate and test new HTTP desync attack techniques against authorized bug-bounty targets. The research emphasizes that human expertise remained important in steering follow-on discoveries. ### Source excerpt We already know AI can find vulnerabilities. James Kettle, PortSwigger's Director of Research, wanted to answer a harder question: can an autonomous system invent genuinely new attack techniques? To f ## How Burp AT helped expose whistleblower reports via a critical vulnerability that was overlooked for years DevFeed: [How Burp AT helped expose whistleblower reports via a critical vulnerability that was overlooked for years]() Original publisher: [Read original article]() Author: Andrzej Matykiewicz Published: 2026-08-04T14:45:31Z Content type: article Language: en Sources: [PortSwigger Blog]() Topics: [Security](), [vulnerability](), [JavaScript](), [Code](), [API](), [Web]() Tags: [agent](), [api](), [code](), [javascript](), [security](), [vulnerability](), [web]() ### AI overview A security analyst describes how Burp AT analyzed a large client-side JavaScript bundle and uncovered a critical vulnerability in a whistleblower reporting system. Reports were protected only by six-character alphanumeric codes, making brute-force access and disclosure of confidential reports possible; Burp AT then helped demonstrate the exploit using an Intruder attack. ### Source excerpt "It feels like I get 10X the productivity on an engagement. The difference is night and day." Profile Ray Huygen is a Security Analyst at Orange Cyberdefense, a managed security service provider with ## From capable AI models to trusted security testing DevFeed: [From capable AI models to trusted security testing]() Original publisher: [Read original article]() Author: Kieron Hughes Published: 2026-07-30T14:58:47Z Content type: article Language: en Sources: [PortSwigger Blog]() Topics: [Security](), [Artificial Intelligence](), [AI Models](), [Vulnerabilities](), [Authorization]() Tags: [agentic](), [ai](), [audit-trail](), [black-hat](), [code](), [http](), [models](), [research](), [security](), [tools](), [vulnerabilities]() ### AI overview PortSwigger describes Burp AT, launched in public beta for Burp Suite Professional users, as a response to research into agentic systems for security testing. The article explains how agents can generate hypotheses, test them, interpret evidence, and pursue longer chains of work, while Burp enforces permissions and scope boundaries, pauses for approval when configured, and records requests and tool activity for inspection. ### Source excerpt This week, we launched Burp AT in public beta for Burp Suite Professional users. Next week at Black Hat, PortSwigger Research will reveal more of the work that helped shape our direction. Burp AT is o ## Introducing Burp AT: agentic AI, built on two decades of Burp Suite DevFeed: [Introducing Burp AT: agentic AI, built on two decades of Burp Suite]() Original publisher: [Read original article]() Author: Fran Hutchings Published: 2026-07-27T12:51:51Z Content type: release Language: en Sources: [PortSwigger Blog]() Topics: [Vulnerabilities](), [AI Bots]() Tags: [agentic-ai](), [agents](), [frontier-ai-models](), [release](), [skills](), [tools](), [vulnerabilities]() ### AI overview Burp AT launches in public beta for Burp Suite Professional, bringing agentic AI into human-led penetration testing with specialist tools, project context, and enforced boundaries. ### Source excerpt Burp AT brings agentic AI to human-led pentesting, with Burp Suite's proven tools, your project context, and purpose-built skills. You decide how much work agents take on. Burp enforces the boundaries ## Burp's new Ambassadors: learn from the people who use Burp Suite everyday DevFeed: [Burp's new Ambassadors: learn from the people who use Burp Suite everyday]() Original publisher: [Read original article]() Author: Fran Hutchings Published: 2026-07-17T13:35:25Z Content type: article Language: en Sources: [PortSwigger Blog]() Topics: [Application Security](), [web applications](), [Cybersecurity](), [Mobile Security](), [Bug Bounty]() Tags: [ambassador](), [application-security](), [bounty](), [bug-bounty](), [community](), [cybersecurity](), [mobile](), [security](), [testing](), [web]() ### AI overview PortSwigger introduces four new Burp Ambassadors and highlights their contributions to web application security, including research, education, penetration testing, bug bounty work, community events, and practical Burp Suite workflows. ### Source excerpt Growing our Burp Ambassador community Meet our newest Burp Ambassadors Katie Paxton-Fear Malek Mohammad Yogesh Tantak James Lester Looking ahead Interested in getting involved? Growing our Burp Ambass ## Heading to Vegas? Meet PortSwigger at Black Hat, BSides, and DEF CON 34. DevFeed: [Heading to Vegas? Meet PortSwigger at Black Hat, BSides, and DEF CON 34.]() Original publisher: [Read original article]() Author: Fran Hutchings Published: 2026-07-09T09:20:06Z Content type: news Language: en Sources: [PortSwigger Blog]() Topics: [Cybersecurity](), [Application Security](), [Security](), [Extension](), [Web](), [IntelliJ IDEA]() Tags: [black-hat](), [cybersecurity](), [event](), [events](), [extension](), [intellij](), [java](), [security](), [testing](), [web]() ### AI overview PortSwigger announces its presence at Black Hat USA, BSides Las Vegas, DEF CON 34, and related events in Las Vegas, including workshops, hands-on sessions, research talks, and opportunities to discuss Burp Suite, web security, security testing, and AppSec workflows. ### Source excerpt First hand of the week: Find us at BSides Workshop: Burp But Yours, with Hannah and Tib3rius Center stage: Visit us at Black Hat USA - Booth 5342 Lightning talks at the booth Catch our researchers' br ## Burp Extensibility 2026: Awards, Talks, and Highlights DevFeed: [Burp Extensibility 2026: Awards, Talks, and Highlights]() Original publisher: [Read original article]() Author: Fran Hutchings Published: 2026-06-19T12:18:14Z Content type: article Language: en Sources: [PortSwigger Blog]() Topics: [Extension](), [Reconnaissance](), [Authentication](), [Authorization](), [JSON Web Tokens](), [Vulnerabilities]() Tags: [auth](), [awards](), [community](), [discord](), [extension](), [pii](), [secrets](), [tokens](), [vulnerabilities](), [workshops]() ### AI overview PortSwigger's Extensibility Month highlighted Burp Suite extensions, Bambdas, and BChecks through talks, workshops, community sessions, and the 2026 Burp Extension Awards. The article summarizes the community-voted award process and notable tools for reconnaissance, authentication, access control, workflow manipulation, and vulnerability discovery. ### Source excerpt The 2026 Burp Suite Extension Awards Best Recon & Discovery Best Auth & Access Control Best Workflow & Manipulation Best API & Specialist Testing Hidden Gem Most Nominated The talks In ## The beast needs a cage: What's next for AppSec post-Mythos DevFeed: [The beast needs a cage: What's next for AppSec post-Mythos]() Original publisher: [Read original article]() Author: Dafydd Stuttard Published: 2026-05-12T14:18:47Z Content type: opinion Language: en Sources: [PortSwigger Blog]() Topics: [Vulnerabilities](), [AI Chat](), [AI Bots]() Tags: [ai](), [audit-trail](), [cybersecurity](), [llms](), [safety](), [vulnerabilities]() ### AI overview An opinion piece on how increasingly capable LLMs could automate application-security vulnerability workflows, while their nondeterminism and ability to act create safety and assurance challenges. ### Source excerpt Now that the dust has settled on Mythos dropping, there is space for more considered reflection on the direction of travel. Mythos wasn't a surprise; it's another data point on a trajectory that's bee ## 3 ways custom scan checks turn practitioner knowledge into scalable automation DevFeed: [3 ways custom scan checks turn practitioner knowledge into scalable automation]() Original publisher: [Read original article]() Author: Hassan Ud-Deen Published: 2026-05-01T06:52:00Z Content type: article Language: en Sources: [PortSwigger Blog]() Topics: [vulnerability]() Tags: [apis](), [automation](), [security](), [testing](), [vulnerability]() ### AI overview The article explains how Burp Suite custom scan checks turn pentesters' vulnerability knowledge and manual proofs of concept into repeatable, scalable DAST tests. It describes using tailored detection logic to rapidly assess applications and APIs after a CVE disclosure. ### Source excerpt Senior pentesters have a deeply refined intuition about what is vulnerable in an environment. The problem? That expertise is often siloed with an individual and trapped in their notes or Python scripts. ## PortSwigger recognized at the Northern Tech Awards 2026. DevFeed: [PortSwigger recognized at the Northern Tech Awards 2026.]() Original publisher: [Read original article]() Author: Fran Hutchings Published: 2026-04-28T10:42:54Z Content type: news Language: en Sources: [PortSwigger Blog]() Topics: [Application Security](), [Security](), [Web]() Tags: [application-security](), [awards](), [global](), [growth](), [innovation](), [leadership](), [security](), [web]() ### AI overview PortSwigger won the Overall Judges' Award at the 2026 Northern Tech Awards, recognizing its performance in growth, innovation, global ambition, cultural excellence, and leadership. The company says it will continue investing in research, evolving its products, and supporting its mission to help secure the web. ### Source excerpt We're proud to announce that PortSwigger recently won the Overall Judges' Award at the Northern Tech Awards 2026. The Northern Tech Awards are run by GP Bullhound, the tech advisory and investment fir ## Introducing the official Burp Ambassador Program DevFeed: [Introducing the official Burp Ambassador Program]() Original publisher: [Read original article]() Author: Fran Hutchings Published: 2026-04-16T13:24:25Z Content type: news Language: en Sources: [PortSwigger Blog]() Topics: [Application Security]() Tags: [ambassador](), [bug-bounty](), [community](), [cybersecurity](), [extension]() ### AI overview PortSwigger announces the Burp Ambassador Program, a community initiative for experienced Burp users to help shape Burp Suite and share application-security knowledge. ### Source excerpt Why we're launching the program What it means to be a Burp Ambassador What we're aiming for Our Burp Ambassadors Alan Levy Corey Ball Federico Dotta Rana Khalil Tib3rius Looking ahead Get Involved - B ## PortSwigger partners with Meta Bug Bounty to empower bug hunters with training and Pro licenses DevFeed: [PortSwigger partners with Meta Bug Bounty to empower bug hunters with training and Pro licenses]() Original publisher: [Read original article]() Author: Fran Hutchings Published: 2026-04-07T12:12:07Z Content type: release Language: en Sources: [PortSwigger Blog]() Topics: [Bug Bounty](), [Application Security](), [Web](), [Meta](), [Tooling]() Tags: [accessibility](), [bounty](), [bug-bounty](), [collaboration](), [education](), [meta](), [partners](), [security](), [tooling](), [training](), [web]() ### AI overview PortSwigger announces a partnership with Meta Bug Bounty to provide eligible bug hunters with training, learning pathways, and Burp Suite Professional licenses. The initiative aims to improve testing efficiency, help researchers identify high-impact vulnerabilities, and strengthen the global security research community. ### Source excerpt More power for bug hunters An education-first approach to bug bounty Rewards on Meta's Bug Bounty Platform Our shared vision Ready to get started? We're excited to announce a new partnership with Meta ## HTTP/1.1 Must Die: Conquering the 0.CL Challenge DevFeed: [HTTP/1.1 Must Die: Conquering the 0.CL Challenge]() Original publisher: [Read original article]() Author: Fran Hutchings Published: 2026-03-13T09:21:19Z Content type: article Language: en Sources: [PortSwigger Blog]() Topics: [Security](), [Parser](), [payload](), [Extension](), [Script]() Tags: [article](), [extension](), [http](), [payload](), [security](), [techniques](), [tools]() ### AI overview A technical guide to the 0.CL variant of HTTP request smuggling, explaining the front-end/back-end parsing discrepancy, four proof-of-concept approaches, and detection with PortSwigger's HTTP Request Smuggler extension in a controlled lab. ### Source excerpt Note: This is a guest post by pentester Julen Garrido Estévez (@b3xal). 1. Acknowledgements 2. Intro 3. Required tools 4. Strategy to solve/exploit the lab 5. Detecting 0.CL 5.1. Practical confirmatio ## Automation without alignment: The hidden cost of modern DAST DevFeed: [Automation without alignment: The hidden cost of modern DAST]() Original publisher: [Read original article]() Author: Dafydd Stuttard Published: 2026-03-12T12:02:57Z Content type: article Language: en Sources: [PortSwigger Blog]() Topics: [Application Security](), [Automation](), [Security](), [Web app](), [Web]() Tags: [automation](), [security](), [testing](), [tool](), [web](), [workflows]() ### AI overview The article argues that modern DAST automation delivers diminishing returns when it operates separately from manual web security testing. It presents DAST as an extension of practitioner workflows that still requires human judgment, and highlights the friction created when automated findings must be validated in a separate tool. ### Source excerpt Watch the webinar recording: Burp Suite DAST x Burp Suite Professional: Better Together I'm a firm believer that if you want to understand how secure an application really is, you have to test how it ## PortSwigger X Intigriti: Burp Suite Professional licenses up for grabs with this new collaboration DevFeed: [PortSwigger X Intigriti: Burp Suite Professional licenses up for grabs with this new collaboration]() Original publisher: [Read original article]() Author: Fran Hutchings Published: 2026-03-11T10:36:26Z Content type: news Language: en Sources: [PortSwigger Blog]() Topics: [Vulnerabilities]() Tags: [bug-bounty](), [collaboration](), [security](), [testing](), [vulnerability-disclosure](), [web]() ### AI overview PortSwigger and Intigriti announced a collaboration that awards eligible bug bounty researchers a six-month Burp Suite Professional license after reaching 400 reputation points on Intigriti. ### Source excerpt At PortSwigger, we're always looking for ways to enable the world to secure the web, and today we're excited to take that mission a step further. We're pleased to announce a new collaboration bringing ## How I sped up exploit validation in Repeater using Burp AI DevFeed: [How I sped up exploit validation in Repeater using Burp AI]() Original publisher: [Read original article]() Author: Hassan Ud-Deen Published: 2026-01-22T15:18:00Z Content type: article Language: en Sources: [PortSwigger Blog]() Topics: [AI Chat]() Tags: [ai](), [api](), [auth](), [authentication](), [rest-api](), [saas](), [security](), [testing](), [validation](), [workflow]() ### AI overview A practitioner describes using Burp AI in Burp Suite Repeater to speed up exploratory application-security testing. In a time-boxed SaaS API assessment, it suggested concrete access-control tests based on a selected request and response. ### Source excerpt Note: This is a guest post by IT security consultant Adarsh Kumar. I've been using Burp Suite day to day for years, so when Burp AI was introduced, I was curious how it would actually hold up dur ## Functional PoCs in less than a minute? Julen Garrido Estévez puts Burp AI to the test DevFeed: [Functional PoCs in less than a minute? Julen Garrido Estévez puts Burp AI to the test]() Original publisher: [Read original article]() Author: Hassan Ud-Deen Published: 2026-01-16T00:00:00Z Content type: article Language: en Sources: [PortSwigger Blog]() Topics: [Artificial Intelligence](), [Prompt Engineering](), [Security](), [Vulnerabilities](), [Web]() Tags: [ai](), [analysis](), [cost](), [generation](), [hallucinations](), [insights](), [security](), [time](), [vulnerabilities](), [web]() ### AI overview A pentester evaluates Burp AI in Repeater using controlled tests across Web Security Academy labs, a deliberately vulnerable shop, and personal environments. The article compares prompting styles by cost, requests, time to proof of concept, adherence, and hallucinations, finding that clear free-form prompts provided the best overall balance and produced a valid PoC at low cost. ### Source excerpt Note: This is a guest post by pentester Julen Garrido Estévez (@b3xal). Methodology Key results Examples Key learnings Prompt template A pentester's POV on Burp AI Pentester Julen Garrido Es ## Burp On Tour 2025: bringing the AppSec community together around the world DevFeed: [Burp On Tour 2025: bringing the AppSec community together around the world]() Original publisher: [Read original article]() Author: Amelia Coen Published: 2025-12-12T11:34:28Z Content type: article Language: en Sources: [PortSwigger Blog]() Topics: [Application Security](), [Security](), [Artificial Intelligence](), [HTTP](), [Testing](), [CI/CD](), [web applications]() Tags: [agentic-ai](), [ai](), [application-security](), [black-hat](), [ci-cd](), [developer](), [http](), [web-apps]() ### AI overview Burp On Tour 2025 brought Burp Suite and PortSwigger representatives to universities, security conferences, meetups, and global events to connect with the application security community. The article highlights research on risks in applications relying on downstream HTTP/1.1, new agentic AI capabilities in Burp AI, and Burp Suite DAST runtime testing for modern web applications and APIs with CI/CD integration. ### Source excerpt In 2025, we set out with a simple mission: take Burp Suite on the road and meet the global AppSec community where you are. Burp On Tour was born from our desire to learn from you; the brilliant people ## DAST without disruption: Burp Suite DAST winter update 2025 DevFeed: [DAST without disruption: Burp Suite DAST winter update 2025]() Original publisher: [Read original article]() Author: Rob Samuels Published: 2025-12-11T13:09:30Z Content type: release Language: en Sources: [PortSwigger Blog]() Topics: [Application Security](), [Security](), [CI/CD](), [Authentication](), [Deployment](), [API](), [OpenAPI Specification](), [Postman](), [JavaScript](), [CSS](), [selectors](), [Single-page application (SPA)]() Tags: [2025](), [authentication](), [automation](), [ci-cd](), [deployment](), [environment-variables](), [javascript](), [openapi](), [real-time](), [responses](), [security](), [selectors](), [troubleshooting](), [ui](), [update]() ### AI overview A winter 2025 update to Burp Suite DAST adds scan freeze windows, improved site and folder management, editable recorded login flows, real-time authentication diagnostics, XPath and CSS session checks, and imports for Postman collections with environment variables. The changes aim to make automated application and API security scanning more reliable and easier to manage at scale. ### Source excerpt AppSec teams are under constant pressure to secure fast-moving applications without slowing anything down. But scanning windows, fragile authentication, and sprawling API estates often get in the way ## How to detect React2Shell with Burp Suite DevFeed: [How to detect React2Shell with Burp Suite]() Original publisher: [Read original article]() Author: Tom Ryder Published: 2025-12-05T13:53:30Z Content type: tutorial Language: en Sources: [PortSwigger Blog]() Topics: [Vulnerabilities](), [Exploit](), [Security](), [Next.js](), [React](), [Testing](), [configuration]() Tags: [2025](), [automated](), [community](), [configuration](), [cve](), [exploit](), [how-to](), [incident](), [log4j](), [next-js](), [ransomware](), [react](), [security](), [vulnerabilities]() ### AI overview This tutorial explains how to detect the React2Shell vulnerabilities (CVE-2025-55182 and CVE-2025-66478) in Next.js-based applications using Burp Suite. It describes built-in default scans, custom scan configuration, and ActiveScan++ for automated detection and investigation. ### Source excerpt Detecting React2Shell with Burp Suite Two new critical vulnerabilities, collectively known as React2Shell (CVE-2025-55182 and CVE-2025-66478), are rapidly gaining traction in the security community. D ## PortSwigger x TryHackMe: Supporting Advent of Cyber DevFeed: [PortSwigger x TryHackMe: Supporting Advent of Cyber]() Original publisher: [Read original article]() Author: Hassan Ud-Deen Published: 2025-12-01T09:00:00Z Content type: news Language: en Sources: [PortSwigger Blog]() Topics: [Security](), [Application Security](), [Testing](), [Automation](), [Artificial Intelligence](), [Web]() Tags: [ai](), [automation](), [beginner](), [community](), [learn](), [security](), [testing]() ### AI overview PortSwigger describes its support for TryHackMe's Advent of Cyber, a December event built around beginner-friendly, hands-on security challenges. The article highlights web security, Burp Suite workflows, automation, and BurpAI, while presenting AI assistance as a way to improve pentesting efficiency without replacing human expertise. ### Source excerpt Every December, TryHackMe's Advent of Cyber brings the security community together around a simple idea: learn something new by getting hands-on. Each day during the festive season reveals a beginner- ## Hacking with Burp AI in the Chesspocalypse: API expert Corey Ball showcases how Burp AI can support pentesters. DevFeed: [Hacking with Burp AI in the Chesspocalypse: API expert Corey Ball showcases how Burp AI can support pentesters.]() Original publisher: [Read original article]() Author: Amelia Coen Published: 2025-11-14T15:09:32Z Content type: article Language: en Sources: [PortSwigger Blog]() Topics: [Artificial Intelligence](), [Application Security](), [Security & Privacy](), [Vulnerabilities](), [Testing](), [web applications]() Tags: [agentic-ai](), [ai](), [article](), [cybersecurity](), [security](), [testing](), [vulnerabilities](), [web-app]() ### AI overview The article presents Burp AI in Burp Suite Professional as an agentic AI assistant for penetration testing. Corey Ball demonstrates how it analyzes requests, identifies vulnerabilities, adapts testing from failed SQL injection attempts to NoSQL injection, uncovers a flaw exposing coupon data, and explains findings to help testers learn and work more effectively. ### Source excerpt AI isn't just reshaping cybersecurity - it's challenging testers to rethink their entire playbook. In his latest article, "Hacking with Burp AI in the Chesspocalypse", API expert Corey Ball draws less ## Can Burp AI hack a website? CyberMaddy explores the new agentic capabilities in Burp AI DevFeed: [Can Burp AI hack a website? CyberMaddy explores the new agentic capabilities in Burp AI]() Original publisher: [Read original article]() Author: Amelia Coen Published: 2025-10-22T13:15:24Z Content type: news Language: en Sources: [PortSwigger Blog]() Topics: [Vulnerabilities](), [AI Chat]() Tags: [agentic](), [ai](), [bug-bounty](), [llm](), [sql](), [testing](), [video](), [vulnerabilities](), [web](), [workflow]() ### AI overview A video examines Burp AI's agentic capabilities for ethical web-security testing, including its use in Repeater to identify SQL injection, XSS, and insecure configurations. ### Source excerpt In her latest video, CyberMaddy dives into the world of AI-driven ethical hacking, exploring how Burp AI performs in Repeater when tasked with finding web vulnerabilities like SQL injection, cross-sit ## Burp AI takes on a vulnerable web app: watch Tib3rius put Burp's new agentic capabilities to the test DevFeed: [Burp AI takes on a vulnerable web app: watch Tib3rius put Burp's new agentic capabilities to the test]() Original publisher: [Read original article]() Author: Amelia Coen Published: 2025-10-22T12:59:05Z Content type: article Language: en Sources: [PortSwigger Blog]() Topics: [Artificial Intelligence](), [Web app](), [Testing](), [Vulnerabilities]() Tags: [agentic](), [ai](), [blog](), [blog-post](), [exploits](), [false-positives](), [real-time](), [testing](), [video](), [vulnerabilities](), [web-app](), [workflow]() ### AI overview A video demonstrates Burp AI testing a deliberately vulnerable web app. It shows Burp AI autonomously exploiting discovered vulnerabilities, identifying false positives, and using agentic capabilities in Repeater to adapt payloads and approaches through natural-language prompts. ### Source excerpt What happens when you set Burp AI loose on a deliberately vulnerable web app? In his latest video, Tib3rius takes Burp's new agentic Burp AI capabilities for a spin - and the results are seriously coo [Next page]()