Google has disclosed that its internal AI security agent, PageBreak, has validated more than 500 cross-site scripting (XSS) vulnerabilities across the company's first-party web applications. The disclosure came in a September 24, 2026 blog post by information security engineer Michał Bentkowski, with the tally covering Google's broader web app estate. By comparison, among hundreds of applications built on Google's high-assurance web frameworks, PageBreak found only two XSS vulnerabilities as of September 4, 2026. Both of those were confined to internal applications or debug endpoints with gaps in their security protections.
PageBreak began as a pilot in November 2025 and became a formal project in January 2026. Most scans use Gemini models, including Gemini 3.1 Pro and Gemini 3.5 Flash, though the agent can work with other models. What sets PageBreak apart is a validation step: rather than sending every suspected bug to product teams, the agent passes each candidate to a purpose-built validator that attempts to fire a working exploit against a running instance of the application. For XSS, the validator injects a JavaScript payload, loads the page, and checks whether the script executes. Google says this has kept the false positive rate close to zero. The validator can also test for SQL injection, path traversal, code execution, and requests sent to internal services.
Google says the system addresses the problem of AI-generated security reports overwhelming teams with unverified hypotheses. Unverified candidates remain in the security team's workflow, where they can guide later scans or help engineers build new validators, but they are not sent to product teams as confirmed bugs. PageBreak also leverages Google's code repository to trace execution paths across services, live traffic security data to map page requests back to source code, and existing scanners that provide authenticated access to internal sites. Google plans to integrate PageBreak more closely with CodeMender, an agent that generates bug fixes, so product teams can review proposed patches alongside confirmed vulnerabilities.
The challenge of verifying AI-generated security findings has also appeared in crypto software. The Ethereum Foundation reported one confirmed flaw in libp2p, later disclosed as CVE-2026-34219, while warning that plausible reports can involve unreachable code or attack conditions that do not hold in practice. An August Bitcoin Red Team scan logged 7,958 findings across 501 open-source projects after 108 hours, but only 24.7% had reproducible proofs at that point. Cosmos Labs co-CEO Barry Plunkett said in April that bug bounty submissions had risen 900% year-over-year, including both valid and invalid reports.
