🛡️Google's PageBreak Agent Finds 500+ XSS Flaws Since January

Google's AI bug hunter only tells you when it's proven

Google's PageBreak security agent has logged over 500 XSS vulnerabilities across its own web apps since going fully live in January. The trick is that it almost never cries wolf. Gemini models do the investigating, but nothing gets reported until a deterministic validator reproduces the exploit against a running app with a real payload. If you ship web apps, this is a preview of how automated security scanning is heading. Most scanners flood you with pattern-matched maybes. PageBreak throws those away and keeps internal notes on the non-verified stuff to seed deeper future scans. The validators are plain code written by security engineers, not by the model, so every confirmed finding is reproducible and boring in the best way. Google also leans on its monorepo visibility and internal security signals, which outside teams won't have. The numbers: 500+ XSS findings, three documented technical cases (XSS, cache poisoning, path traversal), and a near-zero false-positive rate that Google claims. The catch? Those 500 findings haven't been independently validated, and the validators don't cover every vulnerability type or complex scenario. That means some real bugs will slip through as false negatives. Google is also wiring PageBreak into its agentic security work to auto-generate fixes.