Google’s PageBreak AI Identifies 500+ XSS Flaws in Internal Apps

The project, which transitioned from a pilot in November 2025 to a formal initiative in January 2026, represents a shift in how the company handles automated vulnerability discovery. Rather than overwhelming developers with theoretical attack paths, PageBreak employs a two-tier process: Gemini models identify potential entry points, while a separate, non-AI validator attempts to execute a JavaScript payload against the live application. Only when this secondary check confirms the vulnerability does the report reach product teams.

This verification layer is critical to Google’s security strategy. By ensuring that only functional exploits are escalated, the team maintains a near-zero false positive rate. The system demonstrates the effectiveness of Google’s internal architecture; applications built on the company’s high-assurance frameworks yielded only two XSS findings as of September 4, both of which were isolated to debug endpoints or internal tools. Looking ahead, Google intends to integrate PageBreak with CodeMender, an automated repair agent designed to suggest patches for identified flaws, potentially streamlining the remediation cycle for security engineers.