Google's PageBreak AI agent found over 500 XSS flaws in its own web apps

Google has published details of PageBreak, an internal AI agent that hunts for security flaws in the company's own web applications. Run at massive scale, it has uncovered more than 500 cross-site scripting (XSS) vulnerabilities across Google's first-party web applications, some of them on sensitive domains, Google security engineer Michał Bentkowski writes on the company's blog; iThome reports the same figures.

Cross-site scripting is a class of vulnerability in which an attacker manages to inject JavaScript code into a web page viewed by another user, which can let the attacker act in the victim's session. It is one of the most common flaws in web applications.

The problem PageBreak tries to solve: AI slop

Using large language models to scan code has changed vulnerability management, but it has also created noise, Google explains. Many security teams are overwhelmed because a significant share of the candidate reports they receive are unverified hypotheses or false positives produced by models acting as static code analysers, which the company calls AI slop. Telling a genuine, exploitable flaw from a convincing hallucination has become a major challenge that often adds to the burden on product teams.

PageBreak started as a pilot in November 2025 and became a full project in January 2026. It can work with different models, but most of its usage relies on Gemini models such as Gemini 3.1 Pro and Gemini 3.5 Flash, according to Google.

How the validators work

The key design choice is deterministic validation. When the agent identifies a potential flaw, it passes the hypothesis to a specialised validator, written without AI, which executes a real payload against a running environment to confirm the exploit. Unverified candidates are never sent to product teams. Google says this results in a near-zero false positive rate, a point also stressed by iThome.

• XSS: injects a JavaScript payload, loads the URL in a rendering harness and checks whether the injected code actually runs.
• SQL injection: checks whether database queries can be manipulated by looking at the output or the response time.
• Path traversal: creates a file in a world-readable location and checks whether the application can read it.
• Remote code execution: tries techniques such as a sleep delay, writing a file or triggering an outbound DNS or HTTP request.
• Server-side request forgery: detects whether the application makes a request to an internal service.

Google acknowledges that its validators do not yet cover every vulnerability type or complex scenario, which creates a risk of missed flaws. Unverified findings are therefore kept internally: they seed deeper scans in later runs, show where new validators are needed, and the agent reports which capabilities or access it lacked to confirm a finding.

Flaws that humans had missed

Google also described three high-severity cases found by PageBreak in applications that had previously been reviewed by Google security engineers and external bug hunters without these flaws being found, iThome reports. In one case, the agent found an XSS on admin.google.com that required a valid signature on the request; it then found another endpoint that made the application generate a valid signature for a malicious parameter, which allowed an exploit URL to bypass the signature protection. According to Google, such cases show that language models are increasingly able to find vulnerabilities that require several steps to exploit.

Google has published the technical details of these exploits in a companion post on its Bug Hunters blog. Among them is a complex cache poisoning flaw, caused by the misconfiguration of a service, and a case in which the agent bypassed cryptographic protections entirely on its own, according to the company. These examples matter because they go beyond the simple injection patterns that classic scanners already detect.

The agent also benefited from Google-specific advantages, the company says: a single code repository with billions of lines, security signals that map live HTTP traffic to lines of source code, and an existing scanner able to authenticate to nearly every Google web application. To improve its odds, Google runs agents with identical seeds across many iterations.

What secure-by-design frameworks changed

The most striking result concerns applications built on Google's high-assurance web frameworks, designed to eliminate exploitable web vulnerabilities by default. As of September 4, 2026, PageBreak found only 2 XSS vulnerabilities across hundreds of applications built on these frameworks, both limited to internal applications or debug endpoints with hardening gaps, Google writes. Even verified reports still arrive in unprecedented volume, so PageBreak works with other agents such as CodeMender that generate automated fixes, with the aim of reducing product teams' role to validating proposed patches.

What this changes for companies

For Taiwanese software firms and in-house security teams now receiving AI-generated vulnerability reports, Google's approach offers a practical rule: do not act on a model's suspicion until a deterministic test has reproduced the exploit. The framework result is just as useful: the cheapest way to survive automated attackers is to build web applications on frameworks that block whole classes of flaws by default, rather than hunting bugs one by one after the fact.