Google has developed an internal AI agent named PageBreak to autonomously detect security vulnerabilities in its own web applications. Created by Google’s Product Security team, PageBreak has already identified over 500 XSS (Cross-Site Scripting) vulnerabilities.
Unlike conventional AI-based security scanners, PageBreak validates each potential vulnerability by attempting to exploit it in a live environment before reporting it. This approach reportedly achieves a near-zero false-positive rate, addressing the growing challenge of distinguishing genuine security flaws from AI-generated false alarms.
PageBreak was initially piloted in November 2025 and became a full project in January 2026. Built on Google’s Gemini models, it identifies potential flaws and then passes them to a specialized validator that attempts to exploit the vulnerability in a running instance of the application.
The significance of this development is underscored by the increasing prevalence of AI-powered cyberattacks and the difficulty security teams face in filtering legitimate threats from noise. Google notes that asking most AI models to find security vulnerabilities typically yields inaccurate results, highlighting the need for validation systems like those used by PageBreak.
Testing PageBreak against applications built on Google’s newer “high-assurance” web frameworks—designed to make certain vulnerability classes impossible—resulted in only two findings. This supports Google’s assertion that proactive, secure-by-design development practices are more effective than reactive patch management.
Google acknowledges that smaller organizations may lack the infrastructure to replicate PageBreak’s capabilities, as it relies on Google’s extensive unified codebase and established internal security tooling.
Looking ahead, Google plans to integrate PageBreak with CodeMender, its automated bug-fixing agent. This combination would allow confirmed vulnerabilities to be reported with proposed fixes, streamlining the remediation process for developers.
