Google's PageBreak AI Agent Has Found 500+ XSS Bugs, Reporting Only Exploits Validated in Running Apps

Google's AI-powered security agent PageBreak has uncovered more than 500 cross-site scripting (XSS) vulnerabilities across the company's web applications since entering full operation in January, according to a paper published by Google. InfoQ reported the disclosure on Oct 31, 2026. No independent validation of the 500+ figure has been provided.

How PageBreak works

PageBreak uses Gemini models to autonomously investigate potential vulnerabilities. The source does not name a specific Gemini version. The agent reports a finding only after deterministic validators reproduce the exploit against a running application. Each hypothesis is tested with a real exploit:

• XSS: executing JavaScript
• Path traversal: writing to a world-readable location
• RCE: triggering outbound DNS

Google claims this produces a near-zero false-positive rate. Michał Bentkowski, information security engineer at Google, said the team made "a conscious decision to prioritize deterministic validation" early in development, and that the approach avoids overloading product teams with unverified reports.

Lukas Weichselbaum, senior staff information security engineer at Google, wrote on LinkedIn that the model "can suggest whatever it likes, but a finding only counts once a validator confirms it with a real payload." He said the validators are plain code written by security engineers, not by the model, and live outside the agent loop.

Unverified candidates and known gaps

Google keeps non-deterministic findings internally. They are used to seed deeper future scans, identify gaps in validation capabilities and guide the development of new validators. They are not sent to product teams.

Bentkowski acknowledged a limitation: the validators currently lack the capability to cover all vulnerability types or complex scenarios. That carries a risk of false negatives that non-deterministic validators might have caught.

Case studies and environment

In a separate article on Google Bug Hunters, "Google's PageBreak Project, Real-World Findings," Bentkowski describes three cases found by PageBreak: an XSS vulnerability, a cache-poisoning issue caused by a service misconfiguration, and a path-traversal vulnerability.

Bentkowski says PageBreak benefits from Google's engineering environment, specifically:

• End-to-end code visibility through Google's monorepo
• Security signals that connect live HTTP traffic to source code
• Existing scanning infrastructure that provides authenticated access to its web applications

Next step: automated fixes

Google's longer-term goal is to reduce product-team involvement to validating AI-generated fixes. It is integrating PageBreak with other agentic security initiatives such as CodeMender to generate fixes automatically for the vulnerabilities PageBreak discovers.

What this means

PageBreak's design puts the trust decision in deterministic code written by security engineers rather than in the model's judgment. Product teams see only exploits that were reproduced against a running application, which addresses the problem Weichselbaum describes of AI-generated bug reports that sound convincing but turn out to be wrong.

The tradeoff is coverage. By Google's own account, validators do not yet handle all vulnerability types, so some real bugs may sit in the internally retained candidate pool. Google also relies on infrastructure that is specific to its environment, including monorepo visibility and authenticated scanning access. The 500+ count comes from Google itself and has not been independently verified.