Google's AI Security Agent Uncovers Over 500 Web App Vulnerabilities

Google has disclosed that its PageBreak AI security agent has found over 500 cross-site scripting (XSS) vulnerabilities across its web applications. The agent, which began as a pilot in November 2025 and became a formal project in January 2026, tests Google's own web applications and has found XSS flaws even on sensitive company domains.

The PageBreak system uses Gemini models to scan for potential security issues, and separate tools to confirm whether an exploit works. Before sending reports to product teams, each candidate is passed through a specialized validator that checks the finding against running applications.

Google reported two XSS vulnerabilities in applications built on its high-assurance frameworks as of September 4. The company plans to pair PageBreak findings with CodeMender, which generates bug fixes, to help product teams review proposed fixes alongside confirmed vulnerabilities.