Google’s PageBreak Finds over 500 XSS Flaws in Its Web Apps

Google’s PageBreak finds over 500 XSS flaws in its web apps

Google has disclosed that its PageBreak AI security agent has found over 500 cross-site scripting vulnerabilities across the company’s web applications. The Google Product Security team said PageBreak began as a pilot in November 2025 and became a formal project…

AI agent PageBreak finds 500+ Google web bugs, just 2 in hardened apps

Google's AI agent PageBreak confirmed 500+ XSS bugs in Google web apps but only 2 in apps built on its high-assurance frameworks.

Google PageBreak Finds More Than 500 XSS Flaws Across Web Apps

TLDR: Google PageBreak found more than 500 verified XSS vulnerabilities across company web applications after testing suspected exploits in live environments. Dedicated validators test JavaScript payloads and other attack paths, keeping false positives close to zero before reports reach engineers. Two XSS flaws surfaced among hundreds of applications built with high-assurance frameworks, limited to internal [...]

Google Built an AI That Hunts Its Own Security Bugs

Google's PageBreak agent autonomously finds and verifies real vulnerabilities in its own web apps, cutting through the flood of noisy AI-generated security reports.

Google’s AI Found 500 Security Bugs. The Apps Built Properly Had Two

Google has published details of PageBreak, an internal AI agent that hunts for vulnerabilities in the company’s own web applications. It has turned up more than 500 cross-site scripting flaws, some on sensitive domains. The number that deserves more attention sits further down the post. Across hundreds of applications built on Google’s high-assurance web framework, […] The post Google’s AI Found 500 Security Bugs. The Apps Built Properly Had Two…