Google Says Its Page Break AI Found More Than 500 XSS Bugs
· 1:36 · Watch on YouTube ↗
Summary
Google says its Page Break AI agent found over 500 XSS bugs. A separate validator tests whether injected code executes, while findings across hundreds of apps using security frameworks included only two XSS bugs.
Key points
- Google says Page Break, an AI agent that mostly runs on Gemini, found more than 500 cross-site scripting (XSS) bugs in Google applications.
- A separate validator tests suspicious findings against a running app and checks whether injected code executes; unverified findings are not sent to product teams.
- Google says the validation process gives Page Break a near-zero false-positive rate.
- Page Break had access to Google source code, internal security data, and scanners able to log into nearly every Google web app.
- Across hundreds of apps using security frameworks, Page Break found only two XSS bugs involving gaps in those protections.
- The video recommends verifying that an exploit works before sending AI-generated vulnerability reports.
Article Details
- Topics
- [00:00] Google's Page Break AI agent and its reported XSS findings
- [00:26] Validation of suspicious findings by testing whether injected code executes
- [00:52] Page Break's access to source code, internal security data, and web-app scanners
- [01:03] XSS findings in apps using security frameworks and the protections' impact
- [01:21] Google's reported finding count and the recommendation to validate exploits before reporting