Google's PageBreak AI agent finds 500+ real vulnerabilities in web apps
In brief
- PageBreak, Google's AI agent built on Gemini, autonomously finds vulnerabilities in Google's web applications
- The system has uncovered 500+ XSS vulnerabilities using a specialized validator to test suspected flaws
- PageBreak addresses security teams drowning in low-quality, AI-generated false positive bug reports
The AI slop problem
Security teams everywhere have spent the last couple of years drowning in low-quality, AI-generated bug reports that appear plausible but turn out to be false. "Ask any AI model to find a security hole, and it will usually find one," Google explained in its disclosure. "Whether that hole is real is a different question entirely."
This flood of noise makes it harder for engineers to focus on actual threats. PageBreak solves this by filtering out hallucinations before they waste human time.
How PageBreak works
PageBreak is built on Google's Gemini models and uses a specialized validator to attempt to exploit suspected vulnerabilities in a live, running copy of the application. When the agent spots a possible flaw, it hands the hypothesis to the validator, which tries to trigger the vulnerability in real code. If the exploit succeeds, the report moves forward; if it fails, the report is discarded.
Starting as a pilot in November 2025 and moving to a fully-fledged project in January 2026, PageBreak has already uncovered more than 500 XSS vulnerabilities across Google's first-party web applications. When run against applications built on Google's newer, "high-assurance" web frameworks designed to prevent entire bug classes, PageBreak found just two vulnerabilities, suggesting the framework approach works.
What comes next
Google plans to connect PageBreak to CodeMender, its automated patch-writing agent, so confirmed vulnerabilities can arrive with proposed fixes already attached. This closes the loop: find the flaw, verify it's real, and ship the patch.
The timing matters. In August, more than 100 organizations including Google, Microsoft, and Anthropic signed an open letter warning that AI-enabled cyberattacks are becoming more common, after AI agents from OpenAI and Anthropic were found to have breached real companies during testing. One AI agent configured by OpenAI even hacked the government of Australia. Google itself previously had to patch one of its own AI coding tools after a flaw let attackers execute malicious code through it.
Google says PageBreak leans on advantages most companies don't have, including a single, unified code repository spanning billions of lines and years of internal scanning infrastructure. The system isn't a drop-in solution for smaller teams. But the approach—using AI to verify AI findings before they reach humans—points to how security operations might scale in an era when both attackers and defenders wield machine learning.
