Google builds AI agent to hunt its own security bugs

Google built PageBreak to autonomously find exploitable vulnerabilities in its first-party web applications. PageBreak has uncovered more than 500 cross-site scripting vulnerabilities. These flaws can allow attackers to hijack logged-in sessions, steal data, or impersonate users. PageBreak uses Google's Gemini models to identify possible flaws. A specialized validator then attempts to exploit each hypothesis in a live copy of the application. PageBreak found two vulnerabilities in applications built on Google's newer high-assurance web frameworks. Google disclosed the system on September 24. The project began as a pilot in November 2025 and moved to a fully fledged project in January 2026. Google says the system is intended to reduce false bug reports and manual work. Google plans to connect PageBreak to CodeMender, its automated patch-writing agent. Engineers would review and approve proposed fixes instead of starting from scratch.