Google Unveils AI-Powered Security Agent PageBreak

Google has unveiled its AI-powered security agent PageBreak, designed to test the security of its first-party web applications. Built on Google's Gemini model, PageBreak was launched as a pilot project in November 2025 and became a formal project in January 2026. The team aims to autonomously expand vulnerability discovery and reduce manual input.

Unlike traditional AI scanning tools, PageBreak submits potential vulnerabilities to specialized validators before attempting to exploit them in real-time application replicas. Only confirmed vulnerabilities are reported, resulting in a near-zero false positive rate.

PageBreak has identified over 500 XSS (Cross-Site Scripting) vulnerabilities in Google's first-party web applications, which can be used for session hijacking, data theft, or impersonation. The security team at Google has been overwhelmed by reports of AI-generated vulnerabilities that appear plausible but are not valid.

When testing applications built with new-generation high-security frameworks, PageBreak discovered only two vulnerabilities. Google plans to integrate PageBreak with CodeMender, an automated repair agent, to provide fixes for confirmed vulnerabilities.