Google discloses PageBreak AI security agent that found 500+ XSS bugs
Google says its PageBreak agent, powered by Gemini models, has uncovered more than 500 XSS vulnerabilities across its web applications since entering full operation in January. PageBreak pairs model-generated hypotheses with deterministic validators that reproduce exploits against running environments (e.g., executing JavaScript for XSS), producing a near-zero false-positive rate; unverified findings are retained internally to guide validator development. Google plans to integrate PageBreak with other agentic tools like CodeMender to automate fixes; the company’s report notes no independent validation of the 500+ findings.