Google's PageBreak agent finds 500+ XSS bugs with deterministic validation, near-zero false positives
rez0__ · x · 2026-09-30
Google's Product Security team details PageBreak, an internal agentic vulnerability discovery tool piloted in Nov 2025 and fully launched in Jan 2026 to autonomously test first-party web apps.
- Deterministic validation: instead of letting LLMs hypothesize bugs from code patterns, PageBreak verifies each candidate against a running environment, closing the loop on exploitability — yielding a near-zero false positive rate and avoiding the flood of "AI slop" reports.
- Scale and models: primarily powered by Gemini models (Gemini 3.1 Pro, Gemini 3.5 Flash), it has run at massive scale and uncovered over 500 XSS vulnerabilities.
- The project addresses the key bottleneck of LLM-based scanning: noise from unverified hypotheses that burdens product teams.
More from coding & agent
- Millions of personal AI agents 'dots' going live within days, team-of-agents mode teased — blakesamic · 2026-09-30
- AI.CLASSIFY coming to Quail: rethink OLAP-style AI operations on data — sh_reya · 2026-09-30
- Ant Group's Marathoner Trains Agents to Work 10+ Hours With 1000+ Tool Calls — antgroup · 2026-09-30
- Supply Chain Agent Lesson: Memory Knows the Rules, Code Enforces Them — Chemical_Pickle5979 · 2026-09-30
- Artificial Analysis open-sources agent inference benchmark, first results for DGX Spark, RTX 5090, M5 Pro — ArtificialAnlys · 2026-09-30
- Feed Your Agents Markdown: How a Good API Turned cf CLI Into an Unexpected Agent Tool — irvinebroque · 2026-09-30