Google says its AI agent PageBreak has found more than 500 XSS bugs in its web apps
Only reproduced, high-confidence reports reach product teams, and Google's goal is for them to review AI-written fixes instead.
Google says its AI security agent, PageBreak, has surfaced more than 500 cross-site scripting bugs across its web applications since it began full operation in January. PageBreak uses Gemini models to investigate possible flaws, but it only files a report once a deterministic validator reproduces the exploit against a running application, which the company says yields a near-zero false-positive rate. Candidates that validators cannot confirm are kept internally to seed later scans and to find gaps in validator coverage, so product teams see only high-confidence reports. Google's longer-term aim is to cut product-team work down to reviewing AI-generated fixes, and it is linking PageBreak with its CodeMender fix-generation project to get there, though that remains a goal. No independent check of the 500-plus figure has been published.
Why it matters
For people who follow security closely, the claim shows an AI system being trusted to file bug reports only after a deterministic check reproduces each exploit, which is what keeps false alarms low. The same design leaves a gap: Google concedes its validators cannot yet cover every vulnerability type, so some real flaws may be missed without anyone noticing. The 500-plus figure and the near-zero false-positive rate come from Google alone, and no independent check has been published, so the broader picture of AI-driven security work remains unproven outside Google's own products.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.