Google Details PageBreak, an AI Security Agent That Found 500+ XSS Bugs
Google revealed PageBreak, a Gemini-powered security agent that identified over 500 XSS flaws by verifying exploits in live environments to eliminate false positives.
Google has shared architectural details on PageBreak, an internal AI-driven security agent that has identified more than 500 cross-site scripting (XSS) vulnerabilities across its web software since becoming fully operational in January. Powered by Google's Gemini models, the agent navigates software assets to spot potential weaknesses, but it only alerts engineering teams when an exploit can be deterministically reproduced in a live environment.
While generative models have shown promise in code analysis, their tendency to produce plausible but incorrect findings has historically limited their utility in security operations. PageBreak attempts to resolve this issue by decoupling the discovery of vulnerabilities from their verification.
Deterministic verification over hypothetical flaws
Unlike traditional static scanners or standard AI code review setups that alert developers based on pattern recognition, PageBreak requires an exploit to execute successfully against a running application before logging a finding. Depending on the flaw being probed, the agent must trigger real actions: executing JavaScript in the case of XSS, writing a file to a world-readable path for path traversal, or initiating an outbound DNS request for remote code execution.
Lukas Weichselbaum, a senior staff information security engineer at Google, emphasized on LinkedIn why this separation is vital: "A lot of AI-generated bug reports sound convincing but turn out to be wrong, and the teams that get them waste time checking each one. In PageBreak, the model can suggest whatever it likes, but a finding only counts once a validator confirms it with a real payload." Weichselbaum added that these validators consist of plain code written by human security engineers that exist completely outside the core agent loop.
Michał Bentkowski, an information security engineer at Google, explained that this design choice was intentional: "Early on in the development of PageBreak, we made a conscious decision to prioritize deterministic validation. Rather than simply hypothesizing bugs based on code patterns, the system closes the loop by verifying potential flaws against running environments. This approach results in a near-zero false positive rate, ensuring that we avoid overloading product teams with unverified vulnerability reports."
In documentation published on Google Bug Hunters under the title "Google's PageBreak Project – Real-World Findings," Bentkowski outlined three specific issues resolved through the tool: an XSS vulnerability, a cache-poisoning flaw stemming from a service misconfiguration, and a path-traversal bug.
Structural advantages and agent limitations
Google acknowledges that PageBreak relies heavily on internal engineering infrastructure that may be difficult to replicate elsewhere. The agent leverages end-to-end code visibility across Google's monorepo, telemetry that maps incoming HTTP traffic back to source repositories, and an authenticated scanning infrastructure capable of interacting directly with internal web applications.
The system is not without operational trade-offs. Relying strictly on deterministic proof means some real issues are intentionally overlooked if existing validator scripts cannot reliably test them. Bentkowski acknowledged that "while deterministic validation is our gold standard, we are aware that our validators are currently lacking in capabilities to cover all vulnerability types or complex scenarios. This comes with the risk of false negatives that might have otherwise been caught by non-deterministic validators."
Rather than discarding speculative suggestions that fail verification, Google retains non-deterministic findings internally. These candidates serve as data to guide the development of new validators and help seed deeper, targeted scans in subsequent cycles, all without bothering product developers. Looking ahead, Google is linking PageBreak to CodeMender, another internal agent project, with the goal of not just detecting vulnerabilities but automatically creating verified fixes that developers only need to approve. Notably, Google's reported figure of more than 500 discovered XSS vulnerabilities has not been independently verified.
What it means for developers
PageBreak provides a clear blueprint for software teams looking to incorporate large language models into internal security pipelines. The primary takeaway is that an LLM’s predictive strength is best paired with rigid, deterministic testing environments. Rather than treating an AI model as an authoritative auditor, teams achieve better results by using models to generate exploit hypotheses while relying on deterministic testing scripts to validate the outcome.
For engineering teams experimenting with multi-agent security testing or vulnerability analysis, orchestrating model runs across different providers can be resource-intensive. Developers can test and compare state-of-the-art models like Gemini, GPT, and Claude cheaply on a pay-per-token basis using a single API key through Apixo.
Ultimately, PageBreak highlights that scaling automated security auditing depends on tooling integration as much as model intelligence. Without live execution sandboxes, authenticated access to staging targets, and strict automated proof mechanisms, AI vulnerability scanners risk generating more administrative noise than actionable remediation.
Source: Google Discloses PageBreak AI Security Agent That Found 500+ XSS Bugs — InfoQ AI & ML. Written by the Apixo team from that report.
One key for Claude, GPT, GLM, DeepSeek and more. Pay per token with crypto.
Get your API key
