Google Built an AI That Hunts Its Own Security Bugs

Google's Product Security team unveiled an autonomous agent called PageBreak that searches for exploitable flaws in the company's own web applications and validates them before human review. Unlike conventional AI scanners that often produce many dubious findings, PageBreak runs potential vulnerabilities through a dedicated validator that attempts a working exploit against a live, running copy of the application; only confirmed exploits generate reports. According to Google, this approach gives the system a near-zero false-positive rate.

Deployed inside Google's environment, PageBreak has already discovered more than 500 cross-site scripting (XSS) vulnerabilities in first-party web apps. It found far fewer issues when run against applications built with Google's newer, “high-assurance” web frameworks—only two vulnerabilities—an outcome Google cites as evidence that designing safer software frameworks can prevent entire classes of bugs more effectively than post-hoc detection.

Google says PageBreak began as a pilot in November 2025 and expanded into a full project in January 2026. The agent is built on the company's Gemini family of models and leverages Google’s internal repositories and long-running scanning infrastructure—resources Google notes are not easily replicated by smaller organizations. The system was developed in part to cut through what Google calls “AI slop,” the flood of plausible but spurious AI-generated bug reports that have burdened security teams.

Looking ahead, Google plans to integrate PageBreak with CodeMender, an automated bug-fixing agent, so confirmed vulnerabilities can be paired with proposed patches for engineers to review. The announcement occurs amid heightened concern about AI-enabled cyberattacks; in August more than 100 organizations, including Google, Microsoft, and Anthropic, signed an open letter warning that such attacks are on the rise. Google also referenced a prior incident where it had to patch one of its own AI coding tools after a vulnerability was discovered.

By combining automated discovery, live validation, and automated remediation, Google positions PageBreak as a scaled internal capability to reduce manual toil for its security teams. The company frames the work as complementary to efforts that build security into frameworks and development processes, rather than relying solely on detection after deployment.