Google's PageBreak Agent Found 500+ XSS Bugs With Near-Zero False Positives

Google's Product Security team has disclosed PageBreak, an internal AI agent built to autonomously discover and verify vulnerabilities across Google's first-party web applications. Piloted in November 2025 and moved to full operation in January 2026, the system has since surfaced more than 500 cross-site scripting vulnerabilities — a figure Google reports, and which InfoQ notes has not been independently validated. What separates PageBreak from LLM-assisted scanners generating noisy false-positive queues is a deliberate architectural choice: no finding reaches a product team unless deterministic code — not the model — has confirmed the exploit against a live environment.

Agent architecture and the validator layer

PageBreak draws a hard boundary between the model and the confirmation step. Google reports that Gemini models — specifically Gemini 3.1 Pro and Gemini 3.5 Flash — drive hypothesis generation, but each candidate is handed off to a class-specific, human-written validator before it is counted as real. The validators execute actual payloads: for XSS, a JavaScript payload is injected and a rendering harness monitors the execution context; for path traversal, the agent writes a file to a world-readable location and checks whether the application reads it back; for RCE, techniques include introducing a sleep delay, writing to a world-writable location, or triggering outbound DNS or HTTP requests; for SSRF, the validator detects whether the application makes an outbound request to an internal service.

Google's Michał Bentkowski, information security engineer on the project, writes that this approach "results in a near-zero false positive rate." Lukas Weichselbaum, senior staff information security engineer at Google, elaborated on LinkedIn that "the validators are plain code written by security engineers, not by the model and live outside the agent loop" — a structural separation that prevents the model from influencing its own confirmation. Because AI agent security failures most often arise from shared or insufficiently isolated surfaces, placing validation logic entirely outside the model's control is an architecturally meaningful choice.

Where validators cannot yet confirm a finding — because the vulnerability class is unsupported or the scenario is too complex — PageBreak retains those non-deterministic candidates internally. They seed deeper follow-up scans, highlight gaps in validator coverage, and capture the agent's own description of what environment access it would need to confirm the finding. These unverified candidates are never forwarded to product teams.

Infrastructure advantages

Google reports that PageBreak draws on three infrastructure properties that would be difficult to replicate externally. First, the monorepo gives the agent complete, end-to-end code traversal without querying external resources — relevant when a vulnerability originates in a service misconfiguration rather than application code. Second, security signals derived from live HTTP traffic let the agent map request paths directly to source-code lines. Third, PageBreak reuses Google's existing web-application scanning infrastructure, which already has authenticated access to nearly every internal Google web application — eliminating the access-provisioning problem that limits external security tools.

Google also ran PageBreak against applications built on its High-Assurance Web Framework, described in a 2025 blog post. Google reports that as of September 4, 2026, PageBreak identified only 2 XSS vulnerabilities across hundreds of applications built on those frameworks, and both were confined to internal applications or debug endpoints with hardening gaps.

Vulnerability class coverage

To maximise the probability of finding a valid exploit path, Google reports running agents with identical seeds across multiple iterations rather than relying on a single pass.

AI Mastery analysis

PageBreak's architecture illustrates a pattern worth tracking: the model is used as a hypothesis engine, and correctness is enforced entirely by external, deterministic code. This is structurally similar to the bounded-output approach displacing open-ended generation in production AI systems — constrain what the model can claim, then verify with typed, executable logic. The practical consequence is that the false-positive problem becomes a function of validator coverage rather than model accuracy. That shifts engineering effort toward building and maintaining validators, not prompt-tuning or model selection.

The coverage gap is the system's honest limitation: vulnerability classes without a deterministic validator produce only internal seeds, not reports. Google acknowledges the false-negative risk this creates. Any team attempting to replicate this approach faces the same constraint — validator engineering is the rate-limiting investment, not model capability. The monorepo and authenticated-access advantages Google cites are also not portable; a security team running similar infrastructure against a fragmented codebase or SaaS-hosted applications would lose both the full-path code traversal and the built-in authentication layer PageBreak inherits.

The planned integration with CodeMender — routing confirmed vulnerabilities directly into automated fix generation — extends the pipeline toward infrastructure governance as the primary safety mechanism, with human review scoped only to proposed patches. Google reports the longer-term goal is to reduce product-team involvement to simply validating AI-generated fixes.

The broader signal is that sustained, production-scale vulnerability discovery from an AI agent is no longer a research claim. Google is reporting it as an operational outcome, with a concrete count and a framework stress test to support it. Whether the architecture transfers outside Google's specific infrastructure is the question every security engineering team should be asking.

Sources

• Primary: Agentic Hacks, Real Proofs: Inside Google's PageBreak Project
• Reported by: InfoQ AI: Google Discloses PageBreak AI Security Agent That Found 500+ XSS Bugs