Google developed an AI built for finding security flaws inside its own apps, and it has already uncovered more than 500 of them.
PageBreak is the name of the system that was introduced on September 24, and it is Google’s Product Security team built it to hunt real, exploitable vulnerabilities in the company’s own first-party web applications that now include it. This agent waits until it can confirm a bug with a working exploit against a live environment before it reports anything.
The whole point is that design. For the last couple of years, security teams everywhere have been swamped with low-quality bug reports that look plausible but turn out to be nothing. Distinguishing a genuine, exploitable flaw from a convincing hallucination has become a major challenge, Google wrote.
How PageBreak Works
A specialized validator receives every hypothesis the agent raises, which is built on Google’s Gemini models and spots possible flaws. The validator then tests the hypothesis on a live copy of the application. If the test succeeds, the report is confirmed as true. If it fails, the report is discarded.
That design delivers a near-zero false-positive rate, which is important given that security teams have been overwhelmed by low-quality bug reports over the past couple of years, according to Google.
The Numbers Behind PageBreak
So far, researchers have exposed over 500 XSS vulnerabilities within Google’s own web applications, including first-party ones. These flaws give an attacker the means to take over a logged-in session, grab data, or pretend to be a user.
Run against applications built on Google’s newer, “high-assurance” frameworks, PageBreak found just two. That gap shows that building software with safety built in works better than patching holes after the fact.
This year, the stakes involving AI and security have been rising throughout. In August, more than 100 organizations, among them Google, Microsoft, and Anthropic, signed an open letter warning that AI-enabled cyberattacks are becoming more common. The warning came after AI agents from OpenAI and Anthropic were found to have breached real companies during testing.
Since that time, a digital agent put together by OpenAI has broken into the government of Australia, and there has been no end to the reports of other attacks against governments and other targets.
What This Means for Google’s Security
PageBreak works on the opposite side of the same issue: rather than an AI causing a breach, it is an AI attempting to find the flaws before anyone else does. This is not Google’s first encounter with this kind of problem; the company previously patched one of its own AI coding tools after a flaw allowed attackers to execute malicious code through it.
Google says PageBreak relies on advantages that most companies lack, namely a single unified codebase spanning billions of lines and years of internal scanning infrastructure. A small startup cannot duplicate that setup.
With a confirmed vulnerability arriving attached to a proposed fix, engineers are left reviewing and approving work that has already been done rather than starting from scratch. That next step is connecting PageBreak to CodeMender, Google’s automated patch-writing agent.
| Agent | Role | Confirmation Method |
|---|---|---|
| PageBreak | Finds exploitable vulnerabilities | Working exploit against live environment |
| CodeMender | Writes automated fixes | Not described in the announcement |
The clever design behind the system means that PageBreak only reports bugs it has confirmed with a working exploit. Any reports that reach people are almost certainly real. That gives security teams the confidence to trust the output without needing to filter through it.
| Approach | Example | Problem Addressed |
|---|---|---|
| AI-generated bug reports | General scanner output | Flood of low-quality, plausible false alarms |
| PageBreak | Working exploit confirmation | Genuine, exploitable flaws vs. hallucinations |
The announcement carries the weight of a company that has already been breached by its own AI tools. Before, Google had to patch one of its own AI coding tools after a flaw let attackers execute malicious code through it.
Google has turned up more than 500 real security weaknesses using this approach, and the company is now combining PageBreak with CodeMender to close the patch gap.
AI’s role in security depends on which side it ends up on. When it is employed to look for flaws rather than take advantage of them, the balance changes. Google has developed an AI that breaks into its own apps to find security holes, and it has already uncovered more than 500 XSS vulnerabilities.
That is a promising signal for everyone who uses Google’s web applications, though the company has not said whether PageBreak’s findings will change how the applications themselves work.
Source material: “Google Built an AI That Hunts Its Own Security Bugs,” Decrypt.
Get the Notebook.
The day's best stories and every fresh verdict, in plain English, in your inbox by seven. One email a day, no more.