Google says its agent PageBreak found 500 XSS bugs in its own apps

An AI agent can file one hundred bug reports a day. Few help a team. The question is which ones to send up and which to drop.

Google says its PageBreak agent has found more than 500 cross-site scripting bugs in its own apps. The agent went into full use in January. InfoQ reported the figures on 31 October from Google's own paper and two engineer posts.

The validators are code, not the model

PageBreak uses Gemini models to look for bugs. It only files one after a separate check reproduces the exploit against a running copy of the app. The check runs a real payload. For a cross-site scripting bug, that payload is JavaScript. For path traversal, it writes to a world-readable location. For remote code execution, it triggers an outbound DNS lookup. If the payload does not fire, the finding never leaves the agent.

Michał Bentkowski, a security engineer at Google, is quoted in InfoQ. The team made a conscious choice to prioritise this check, he says. The system "closes the loop by verifying potential flaws against running environments". The result is "a near-zero false positive rate". Google says this keeps product teams from drowning in reports they then have to triage by hand.

Lukas Weichselbaum, a senior staff security engineer at Google, posted on LinkedIn. He writes that many AI-generated bug reports sound convincing but turn out wrong. In PageBreak, the model can suggest whatever it likes. A finding only counts once a validator confirms it with a real payload. The validators are plain code, he adds. Security engineers wrote them, not the model, and they live outside the agent loop.

What Google admits the method misses

The validators do not cover every kind of bug yet, Bentkowski writes. Findings that pass the model but fail a validator are kept inside Google. The team uses them to seed deeper scans. They also help build the next validator. Those unverified candidates never reach the product team.

Bentkowski also wrote a separate post on Google Bug Hunters. In it he describes three bugs PageBreak found: a cross-site scripting bug, a cache-poisoning issue from a service misconfiguration, and a path-traversal bug.

Google says the agent gets its leverage from the environment around it. All of Google's code sits in one repository. Security signals connect live HTTP traffic back to the source line. Existing scanners already have authenticated access to the apps. The longer-term aim is to connect PageBreak to CodeMender, a separate Google agent that writes patches. The product team would then only have to approve the fix.

InfoQ notes that no independent party has checked the 500-plus figure. The number is Google's own count, from Google's own paper, measured on Google's own apps.

The lesson for a team running an AI security agent is in the design, not the headline. The model is allowed to be wrong often. The validator catches it. Let a model's claim reach a human unchecked. The review cost moves to the team the agent was meant to help.

Source

InfoQ: Google Discloses PageBreak AI Security Agent That Found 500+ XSS Bugs, by Renato Losio, reporting on a paper by Google and posts by Google engineers Michał Bentkowski and Lukas Weichselbaum.