Google’s PageBreak agent finds 500-plus XSS vulnerabilities

Google has described how PageBreak, an internal AI agent used by its Product Security team, found more than 500 cross-site scripting (XSS) vulnerabilities in Google’s first-party web applications. The company published the account on 24 September 2026. The page metadata gives an original publication time of 01:00 UTC and an update at 14:29 UTC; this article focuses on the findings in that updated account.

PageBreak started as a pilot in November 2025 and became a full project in January 2026. Google says most runs use Gemini 3.1 Pro or Gemini 3.5 Flash, although the agent can work with other models. Its distinctive step is not simply asking a model to flag suspicious code. Non-AI-written validators try to reproduce a candidate flaw against a running application. Different validators check XSS, SQL injection, path traversal, remote code execution and server-side request forgery. Only high-confidence, verified findings go to product teams, while unverified leads stay available for later scans and validator improvement.

Google reports more than 500 XSS findings, including on sensitive domains. As of 4 September, PageBreak had found two XSS vulnerabilities in hundreds of applications built with high-assurance frameworks; both were limited to internal applications or debug endpoints with hardening gaps. These are different populations, so the numbers cannot be used to calculate a failure rate or compare all Google services. Independent coverage from iThome, Technoblog and Tecnologiatoday highlighted the scale and verification approach, but did not provide an independent audit of Google’s count.

Google says PageBreak’s output can connect to CodeMender and other automated-fix initiatives. The company still says product teams must handle reports, and validators can miss bugs they cannot reproduce. The announcement therefore says as much about workflow design as it does about model ability.

For security teams and AI makers, the practical lesson is clear: an agent that generates hypotheses is not enough. Evidence, reproducibility, scoped permissions and human review determine whether automation helps. PageBreak benefits from Google’s codebase, traffic signals and scanning infrastructure, so other organisations cannot assume they will get the same results. AI can widen the search, but secure-by-design frameworks and independent validation remain necessary.