Google's AI Agent Hunts Down Security Bugs Before Attackers Do

Google has developed an AI agent called PageBreak to hunt for real security bugs in its own web applications. The agent, built on Google's Gemini models, uses a specialized validator that tries to exploit potential flaws in live environments before reporting them.

This approach aims to minimize false-positive reports, which have become a major challenge in the field of AI-generated bug reports.

PageBreak has already uncovered more than 500 XSS vulnerabilities across Google's first-party web applications. When paired with CodeMender, an automated patch-writing agent, PageBreak will provide confirmed vulnerabilities along with proposed fixes.

The stakes around AI and security have been climbing all year, with AI-enabled cyberattacks becoming more common. This new development shows that instead of causing breaches, AI can be used to catch bugs before they're exploited by attackers.