GoKawiilGoogle's PageBreak AI agent uncovers over 500 XSS flaws in its own web apps
Google's Product Security team disclosed in a blog post that its internal AI agent, PageBreak, has found more than 500 cross-site scripting vulnerabilities across the company's web applications. The tool, piloted last November and made a full product in January, combines AI analysis with validation to flag exploitable bugs, including a cache poisoning issue on apis.google.com, an XSS flaw on admin.google.com, and insecure handshakes in browser extensions, all of which have reportedly been fixed.
GoKawiil's interpretation of the reporting above, not reported fact.
The project suggests Google sees AI-driven vulnerability hunting as a way to scale security testing beyond what human researchers can manually cover, especially as it plans to pair PageBreak with its CodeMender system to auto-generate fixes. However, engineer Michał Bentkowski acknowledged that distinguishing real flaws from AI hallucinations remains difficult, which could offset some efficiency gains by adding review burden on product teams. This points to broader industry uncertainty about how reliable AI-assisted security tools are in practice.
- PageBreak, a Google internal AI agent, found over 500 XSS vulnerabilities in Google's own web apps.
- Three confirmed flaws—cache poisoning, an XSS bug, and insecure extension handshakes—have already been fixed.
- Google plans to link PageBreak with its CodeMender fix-generation tool, though hallucinated 'flaws' remain a noted challenge.
Source: darkreading.com — Elizabeth Montalbano, 2026-10-06
Published there as: “Google's PageBreak AI Agent Finds 500 Flaws in Its Web Apps”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.