Google’s Product Security team says an internal AI agent called PageBreak has uncovered more than 500 cross-site scripting vulnerabilities across the company’s first-party web applications.
The project is notable not just for the number Google reports, but for how PageBreak separates a plausible vulnerability from one that can actually be reproduced. Google says the agent uses deterministic validators to test suspected flaws against running environments before product teams receive a report.
The full architecture appears in Google’s PageBreak report.
Why validation is the centre of the system
Large language models can trace complicated code paths, but they can also produce convincing false positives. Google says the agent closes that gap by passing each hypothesis to specialised validators that execute a real payload.
For XSS, a validator checks whether injected JavaScript runs in a monitored rendering environment. Other validators test classes such as SQL injection, path traversal, remote code execution and server-side request forgery with class-specific checks.
Google describes the resulting false-positive rate as near zero. That is a company-reported result from its own environment, not an independently measured benchmark.
PageBreak has advantages specific to Google
PageBreak began as a pilot in November 2025 and became a full project in January 2026. Google says most runs use Gemini 3.1 Pro or Gemini 3.5 Flash, though the system can work with different models.
The agent also operates with infrastructure that outside security teams may not have. It can follow execution paths through Google’s monorepo, use security signals derived from live HTTP traffic, and reuse existing scanners that can authenticate to first-party applications.
Those advantages help explain why the reported scale should not be read as a ready-made result for every organisation. Google has not announced PageBreak as a generally available product.
Secure-by-design frameworks still performed better
Google also tested PageBreak against applications built on its high-assurance web frameworks. As of September 4, 2026, the agent had identified two XSS vulnerabilities across hundreds of those applications, according to the company.
The framework comparison uses Google’s secure framework report.
Google says both were limited to internal applications or debug endpoints with hardening gaps. The comparison supports a familiar security principle: automated discovery can find more bugs, but eliminating whole vulnerability classes by design remains the stronger first line of defence.
The next step is fixing, not just finding
PageBreak keeps non-deterministic findings away from product teams. Instead, those candidates can seed later scans, expose missing validator capabilities or guide the creation of new validators.
Google says it is also connecting PageBreak with automated remediation work such as CodeMender. The long-term aim is to pair a verified finding with a proposed fix, leaving product teams to validate the change rather than investigate every speculative alert.
The remediation context comes from Google’s CodeMender update.
PageBreak is still an internal Google project, and its published performance claims come from Google. Even so, its design offers a useful lesson for AI-assisted security tooling: model reasoning becomes more operationally valuable when a separate system can prove the exploit.
