Google reports over 500 XSS findings from its PageBreak agent

Google disclosed results from PageBreak on September 24, saying its internal security agent found more than 500 cross-site scripting vulnerabilities in Google applications. The system checks candidate exploits against running environments before passing findings to product teams, instead of relying solely on model-generated code analysis.

Brief updated 25 Sep 2026, 02:25 UTC · AI-written

Specialized validators test whether proposed attacks actually produce the expected behavior. For cross-site scripting, that means checking whether injected JavaScript executes in the browser context.

Unverified candidates remain available for further investigation and validator development. Google acknowledges that incomplete validator coverage can miss vulnerabilities, and that its extensive internal source access and scanning infrastructure give the project advantages that other organizations may lack.

What remains unclear

Finding counts and near-zero false-positive claims are Google’s own assessment.