cyber.hendryadrian.com
Security News · darkreading.com

Google’s PageBreak AI Agent Finds More Than 500 Flaws in Its Web Apps

· Original article ↗

Summary

Google says its PageBreak security agent found more than 500 flaws in the company’s web apps. It uses separate validators to test potential vulnerabilities with real payloads before reporting confirmed findings.

Key points

  • PageBreak is an internal agent developed by Google’s Product Security team to test the company’s first-party web applications.
  • Google says the agent has identified more than 500 flaws, including cross-site scripting, cache poisoning, and insecure external handshakes in browser extensions.
  • Google described three findings in a companion post and said those flaws have been fixed; the status of all identified flaws was not immediately available.
  • PageBreak tests suspected weaknesses in running environments and reports them only after specialized, non-AI validators execute real payloads to confirm exploitability.
  • The agent primarily uses Gemini models but can work with other models.
  • Google intends to connect PageBreak with CodeMender, its automated vulnerability-fixing system, so engineers can review proposed fixes for verified flaws.

Article Details

Event Type
Google's PageBreak AI agent discovered more than 500 vulnerabilities in Google's first-party web applications.
Impact
The identified flaws include cross-site scripting, cache poisoning, and insecure external handshakes in browser extensions. Google says three described flaws have been fixed; the status of fixes for all identified flaws was not confirmed.

People

Darin FreddeRidge Security senior director of technical marketing engineering who commented on continuous, evidence-driven offensive testing.Michał BentkowskiGoogle information security engineer who described PageBreak and its validation approach.Rickard CarlssonDetectify CEO who commented on AI vulnerability discovery and validation.

Vendors

GoogleA Google internal AI agent has discovered more than 500 cross-site scripting (XXS) flaws on the company's own Web applications, by using a combination of AI and validation to provide an overview of vulnerabilities that

Products

Gemini 3.1 ProGoogle based PageBreak's usage primarily on Gemini models, including Gemini 3.1 Pro and Gemini 3.5 Flash. However, the company said it can work with other models as well.Gemini 3.5 FlashGoogle based PageBreak's usage primarily on Gemini models, including Gemini 3.1 Pro and Gemini 3.5 Flash. However, the company said it can work with other models as well.

Tools

CodeMenderfor all the flaws identified by PageBreak. However, Google eventually intends to connect PageBreak with CodeMender, its automated vulnerability-fixing system, so that once the former identifies a verified flaw, thePageBreakPageBreak is an agent of Google's Product Security team that the company developed to test the security of its first-party Web applications and address any security challenges, the company quietly revealed in a blog

Related Articles