Google Deploys AI Agent PageBreak to Hunt Real Vulnerabilities in Its Own Web Applications

Google just gave one of its AI agents a new job: breaking into Google.

The company disclosed on September 24 that its Product Security team built an autonomous system called PageBreak, designed to hunt for real, exploitable vulnerabilities in Google's own web applications, according to a blog post by information security engineer Michał Bentkowski. The pitch is simple: an AI hacker that doesn't cry wolf.

“PageBreak is an internal AI agent of Google's Product Security team developed to test the security of our first-party web applications and address this challenge,” Google said. “Starting as a pilot in November 2025 and moving to a fully-fledged project in January 2026, its mission is to autonomously scale vulnerability discovery while minimizing manual toil.”

That matters more than it sounds. Security teams everywhere have spent the last couple of years drowning in "AI slop," Google explains, referring to the flood of low-quality, AI-generated bug reports that look plausible but turn out to be nothing.

"Distinguishing a genuine, exploitable flaw from a convincing hallucination has become a major challenge," Google wrote. Ask any AI model to find a security hole, and it will usually find one. Whether that hole is real is a different question entirely.

PageBreak tries to answer that question before a human ever sees the report. When the agent, built on Google's Gemini models, spots a possible flaw, it hands the hypothesis to a specialized validator that actually tries to exploit it in a live, running copy of the application.

PageBreak has already uncovered more than 500 XSS vulnerabilities across Google's first-party web applications, the kind of flaw that can let an attacker hijack a logged-in session, steal data, or impersonate a user on a site you use every day.

Run against applications built on Google's newer, "high-assurance" web frameworks, meant to make entire bug classes structurally impossible, PageBreak found just two. That gap is Google's own evidence that building safer software from the ground up works better than patching holes after the fact.

The stakes around AI and security have been climbing all year.

In August, more than 100 organizations, including Google, Microsoft, and Anthropic, signed an open letter warning that AI-enabled cyberattacks are becoming more common, after AI agents from OpenAI and Anthropic were found to have breached real companies during testing. Since then, an AI Agent configured by OpenAI hacked the government of Australia and the reports of other attacks have not stopped.

PageBreak sits on the other side of that same coin: instead of an AI causing a breach, it's an AI trying to catch the bugs before someone else does. It's not Google's first brush with this problem either; the company previously had to patch one of its own AI coding tools after a flaw let attackers execute malicious code through it.

Google says PageBreak leans on advantages most companies don't have, including a single, unified code repository spanning billions of lines and years of internal scanning infrastructure, so a small startup can't simply copy the approach.

The next step is connecting PageBreak to CodeMender, Google's automated patch-writing agent, so a confirmed vulnerability can arrive with a proposed fix already attached, leaving engineers to review and approve rather than start from scratch.