Google Discloses PageBreak AI Security Agent That Found 500+ XSS Bugs

According to a paper published by Google, its AI-powered security agent has uncovered more than 500 XSS vulnerabilities across its web applications since entering full operation in January. Google PageBreak uses Gemini models to autonomously investigate potential vulnerabilities, but reports them only after deterministic validators successfully reproduce the exploit against a running application, resulting in a near-zero false-positive rate.

With PageBreak, every vulnerability hypothesis is tested against a running environment with a real exploit, such as executing JavaScript for XSS, writing to a world-readable location for path traversal, or triggering outbound DNS for RCE. Michał Bentkowski, information security engineer at Google, explains:

Early on in the development of PageBreak, we made a conscious decision to prioritize deterministic validation. Rather than simply hypothesizing bugs based on code patterns, the system closes the loop by verifying potential flaws against running environments. This approach results in a near-zero false positive rate, ensuring that we avoid overloading product teams with unverified vulnerability reports.

Google also retains non-deterministic findings internally to seed deeper future scans, identify gaps in its validation capabilities, and guide the development of new validators. These unverified candidates are not sent to product teams, keeping their attention focused on high-confidence vulnerabilities. Bentkowski writes:

While deterministic validation is our gold standard, we are aware that our validators are currently lacking in capabilities to cover all vulnerability types or complex scenarios. This comes with the risk of false negatives that might have otherwise been caught by non-deterministic validators.

In the separate article, "Google’s PageBreak Project – Real-World Findings," on Google Bug Hunters, Bentkowski describes three technical cases found by PageBreak: an XSS vulnerability, a cache-poisoning issue caused by a service misconfiguration, and a path-traversal vulnerability. On LinkedIn, Lukas Weichselbaum, senior staff information security engineer at Google, stresses the importance of reducing false positives:

A lot of AI-generated bug reports sound convincing but turn out to be wrong, and the teams that get them waste time checking each one. In PageBreak, the model can suggest whatever it likes, but a finding only counts once a validator confirms it with a real payload. The validators are plain code written by security engineers, not by the model and live outside the agent loop.

Bentkowski says PageBreak benefits from Google's engineering environment, particularly Google’s monorepo end-to-end code visibility, security signals that connect live HTTP traffic to source code, and existing scanning infrastructure that provides authenticated access to its web applications.

With the longer-term goal of reducing product-team involvement to validating AI-generated fixes, Google is integrating PageBreak with other agentic security initiatives such as CodeMender to automatically generate fixes for the vulnerabilities it discovers.

No independent validation of the 500+ vulnerabilities has been provided.