Professional
Getting started with Burp AT
-
Last updated: October 9, 2026
-
Read time: 5 Minutes
Burp AT follows the prompts you send, choosing the right actions for each step and adapting as it learns about your target.
This page walks you through setting up your first task, following Burp AT's work as it runs, and verifying what it finds.
What you need
To use Burp AT, you need:
Burp Suite Professional 2026.7 or later.
A PortSwigger account with a valid Burp Suite Professional license associated.
AI credits on your account. Burp AT uses credits as it works. For more information, see AI credits.
Outbound HTTPS access to
ai.portswigger.netandlogin.portswigger.neton port 443. For help with connectivity to PortSwigger's AI services, see Troubleshooting AI connectivity.A target you're authorized to test.
Running your first task
Step 1: Set your target scope
Burp AT respects the scope you define in Burp, and checks whether a target is in scope before it acts. Set your scope before you start.
For information on how to set scope in Burp, see Target scope.
Keep the scope narrow for your first task. This makes it easier to follow what Burp AT does.
Burp AT can edit scope, but it always asks for approval first. To prevent it from asking, open Tool settings (Settings > Tools) and, on the Enabled tools tab, disable the Add to scope and Remove from scope tools.
Step 2: Open Burp AT
To open Burp AT, click Burp AT in the top-right corner of Burp. You can also press Ctrl+Shift+G (Windows/Linux) or Cmd+Shift+G (Mac), or select Open Burp AT from the command palette.
The first time you open it, Burp asks you to sign in to your PortSwigger account. Sign in with the account your Burp Suite Professional license is registered to. You only need to sign in once, though logins expire after two weeks of inactivity.
Why you need to sign in to Burp AT
Burp AT keeps a persistent, private workspace for your data. Your tasks and findings are saved, enabling you to pick up where you left off. Because that data is sensitive and specific to you, we need you to authenticate when you access Burp AT.
When it opens, Burp AT automatically creates a new task. A task is a conversation focused on one area of testing, and its data is stored in the Burp project you're working in.
Note
For more information on tasks in Burp AT, see Tasks.
Step 3: Set Burp AT's autonomy
Each task has an autonomy mode that defines when Burp AT needs to ask for permission before using a tool. By default, tasks use Smart mode, in which Burp AT approves routine tool use on its own and stops to ask you about anything it judges to be potentially risky.
To change the task's autonomy mode, use the Mode drop-down in the message box.
Note
Smart mode uses AI to judge each action. It may occasionally ask about something harmless, or act on something you'd rather it checked. If you want to approve every action yourself, use Manual mode and set the tools you want to supervise to Ask.
For more information on configuring Burp AT's autonomy, including setting per-tool permissions, see Configuring autonomy.
Step 4: Set reasoning effort
Select Low, Medium, High, or Max from the Effort menu in the message box. Tasks use High by default.
Higher levels use additional time and credits to reason more thoroughly, and are best for difficult work that may benefit from deeper analysis. Lower levels are best for controlling credit use during routine work.
More information
Step 5: Give Burp AT context
You can help Burp AT to focus its work by attaching a Burp resource or external file.
To attach an external file, click the paperclip icon in the message box and select the file. You can also drag a file into the message box or paste it from your clipboard.
To attach a Burp resource:
Right-click a message in Proxy > HTTP history, a node in your site map, or an issue. Select Send to Burp AT.
In Burp AT, click the + icon in the message box. Select the resource from the Burp Resources menu.
Note
The requests Burp AT sends, the responses it receives, and the files or resources you attach may contain sensitive data. Burp AT does not redact this data before sending it to PortSwigger and AI providers. Only attach data that you're permitted to share.
For more information, see Attaching resources and files and AI trust and data handling.
Step 6: Send your first prompt
Enter your prompt in the message box and press the return key.
Say what you want Burp AT to test and what you want to learn. A clear prompt helps it focus. Ask for a result you can verify, so you can check the evidence before reporting it.
For example: Test https://example.com for broken access control on the /admin endpoints. I can sign in as a low-privileged user with these credentials.
This is only an example. Burp AT can handle both broad and focused testing tasks.
More information
Step 7: Watch Burp AT's progress
Burp AT plans an approach and carries it out using Burp's tools, drawing on the resources you've attached and adapting as it learns about your target. It shows its rationale as it goes.
In Smart mode, Burp AT approves routine tool use on its own. If it needs your approval to take an action, it pauses and explains what it wants to do. Click Show details to see the action it plans to take.
Note
A few high-impact tools, such as running a script, adding a target to scope, or creating a custom scan check, always require your approval.
Step 8: Verify what it found
Burp AT records vulnerabilities it finds as issues in Burp, and logs its actions so you can verify its work.
When the task finishes:
Read back through the conversation to see which tools Burp AT used, and click Show details on any action to see further information.
Review any issues Burp AT raised. Select an issue and click Request or Response to see the traffic used to find that issue.
Burp AT is built to extend your testing, not replace your judgment. Treat each finding as a lead to verify before you act on it.
A task is an ongoing conversation, so you can send follow-up prompts to dig into a result, adjust what you asked for, or point Burp AT at something new.