Google's AI security agent PageBreak has identified more than 500 verified cross-site scripting (XSS) flaws across the company's first-party web applications. XSS is an injection bug class in which attacker-supplied script runs in another user's browser, a long-standing web risk because code that executes on a trusted page can act with that page's privileges. The system tests each suspected weakness against working services before a report ever reaches a product team — a validation step that separates usable exploits from believable but faulty attack descriptions produced by AI models. The approach is designed to ensure that every confirmed report corresponds to a working exploit rather than a plausible-sounding claim.

Google began PageBreak as a pilot in November 2025 and made it a formal project in January 2026. The company's Product Security team said the system found XSS flaws on sensitive company domains. Google did not name the affected applications or disclose a severity breakdown; the reported figure covers its web application estate as a whole.

Dedicated Validators Keep False Positives Near Zero

Rather than routing every alert directly to engineers, PageBreak sends each candidate issue to a dedicated validator. For an XSS vulnerability, the validator injects JavaScript into the relevant page and observes whether the code executes. Google said that process holds false positives close to zero and prevents untested claims from reaching product teams for review.

The system validates more than browser scripts. Additional checks determine whether injected inputs alter database queries, expose files through path traversal, or trigger code execution, while a separate validator examines requests that may reach internal services. Those checks allow PageBreak to assess several attack classes while keeping reports focused on working paths. Each candidate requires an independent proof before engineers treat it as a vulnerability.

Most scans run on Gemini 3.1 Pro or Gemini 3.5 Flash, but the exploit checks are performed by separate tools; the validators do not come from the AI agent itself. Google repeats attempts because models can abandon a productive route or pursue an attack path that fails under actual application conditions.

Unverified results do not leave the internal security workflow as confirmed bugs. Teams can instead use them to refine future scans or create additional validators. The distinction matters because language models can produce detailed security narratives that sound convincing but may not reproduce when tested against an actual application — and, at scale, that gap determines whether AI-generated findings save engineering time or consume it in triage.

Two Flaws Surface in High-Assurance Framework Apps

By September 4, PageBreak had identified two XSS vulnerabilities among hundreds of applications built on Google's high-assurance web frameworks. Both cases involved internal applications or debug endpoints that were missing certain protections. The result demonstrates how those framework safeguards perform under repeated automated scanning. The framework count is separate from, and does not include, the more than 500 findings across Google's wider application estate.

PageBreak can inspect code paths across services through the company repository. Security data from live web traffic can connect a requested page with the relevant source code, and existing scanners provide authenticated access to internal sites.

That environment sets PageBreak apart from a public model scan. External researchers cannot usually inspect Google's code, traffic data, or protected testing systems. PageBreak therefore reflects an internal security workflow with deep operational access, and the finding count does not show that another organization could achieve the same results by running Gemini alone.

Repair Workflows: CodeMender Integration Planned

Google plans to connect PageBreak more closely with CodeMender, an agent designed to generate security fixes. Product teams could then review a proposed repair alongside a confirmed vulnerability — an arrangement that would close the loop from discovery to fix. The company said the pairing could reduce the workload created by a large volume of verified findings, though it gave no timetable for the integration.

Comparable verification problems affect crypto software, where AI tools can generate large numbers of plausible security reports. The Ethereum Foundation has used separate reviewers to reproduce findings produced by AI agents, and a Bitcoin Red Team scan found that only 24.7% of the issues reported at the time came with reproducible proofs.

Google has not said whether it will make PageBreak available to external projects.

Source: Blockonomi, based on Google's official PageBreak announcement.