# Google's PageBreak AI security agent reports 500+ XSS bugs

published: 2026-10-31T07:05:29.539Z
topic: infrastructure
source: https://www.infoq.com/news/2026/10/google-pagebreak-security-agent/?utm_campaign=infoq_content&utm_source=infoq&utm_medium=feed&utm_term=AI%2C+ML+%26+Data+Engineering
url: https://aiagentnews.io/stories/google-s-pagebreak-ai-security-agent-reports-500-xss-bugs

Google says its AI security agent PageBreak has uncovered more than 500 XSS vulnerabilities across its web applications since it began full operation in January. The agent reports a finding only after deterministic validators reproduce a real exploit against a running application, which the company says keeps its false-positive rate near zero.

Google says its AI-powered security agent, PageBreak, has found more than 500 cross-site scripting vulnerabilities across its web applications since January. PageBreak uses Gemini models to investigate possible flaws on its own, but it only reports a finding after deterministic validators reproduce the exploit against a running application. The company describes the resulting false-positive rate as near zero.

Each hypothesis is tested in a live environment with a working exploit. Examples include executing JavaScript for XSS, writing to a world-readable location for path traversal, and triggering outbound DNS for remote code execution. Unconfirmed candidates are kept internally to seed future scans, reveal gaps in the validators and guide new validators instead of going to product teams.

Google Bug Hunters describes three cases found by PageBreak: an XSS flaw, a cache-poisoning issue caused by a service misconfiguration, and a path-traversal bug. Google plans to connect PageBreak with CodeMender so that fixes for discovered vulnerabilities are generated automatically, with the longer-term aim of limiting product-team work to validating those fixes. No independent validation of the 500-plus findings has been published.

## Why it matters if you build agents

Developers building security or code-review agents can reuse the pattern here: let the model propose findings, but only surface those confirmed by plain code that runs a real payload against a live target. The design trades coverage for precision, since Google concedes its validators cannot yet cover every vulnerability type or complex scenario. Teams that treat unverified AI bug reports as noise to be triaged may find that gating on validation cuts that workload sharply, at the cost of some missed bugs.