Google AI Agent Uncovers Over 500 XSS Bugs, Most in Regular Apps

Google's AI Security Agent Flags Over 500 XSS Bugs, Only Two in Hardened Apps

The internal AI security agent developed by Google has identified over 500 cross-site scripting vulnerabilities across its first-party web applications. In contrast, only two such flaws were found in apps built on the company's hardened web frameworks.

The agent, named PageBreak, uses a two-stage architecture to identify and validate suspected XSS flaws. It first employs Gemini models to detect potential issues, which are then verified by purpose-built validators that attempt to execute actual exploits against running instances of the application.

PageBreak has been running since November 2025, with its mission to autonomously scale vulnerability discovery while reducing manual effort. The agent also tests for other attack classes beyond XSS, including SQL injection and path traversal.