Google AI agent PageBreak finds over 500 security bugs

Key facts

• Google's Product Security team developed an AI agent named PageBreak to find security bugs.
• PageBreak has found over 500 bugs in Google's web applications.
• The AI agent confirms bugs with a working exploit, resulting in a near-zero false-positive rate.
• PageBreak is built on Google's Gemini AI models.
• Google plans to integrate PageBreak with its automated bug-fixing agent, CodeMender.

Google has revealed PageBreak, an artificial intelligence agent developed by its Product Security team to identify and exploit vulnerabilities in the company's own web applications. The system, detailed in a blog post by information security engineer Michał Bentkowski, aims to address the challenge of distinguishing genuine, exploitable flaws from the numerous plausible but false reports generated by AI tools.

PageBreak, built on Google's Gemini models, operates by first hypothesizing a vulnerability and then using a specialized validator to attempt an exploit in a live environment. This process ensures a near-zero false-positive rate. The AI has already identified over 500 cross-site scripting (XSS) vulnerabilities across Google's first-party web applications. When tested on applications built with Google's newer, high-assurance web frameworks designed to prevent certain bug classes, PageBreak found only two vulnerabilities, which Google cites as evidence for the effectiveness of building safer software from the ground up.

The development comes amid growing concerns about AI-enabled cyberattacks. In August, over 100 organizations, including Google, Microsoft, and Anthropic, signed an open letter warning about the rise of such threats. PageBreak represents an effort to leverage AI for defense rather than offense, catching bugs before they can be exploited by malicious actors. Google notes that its approach benefits from a unified code repository and extensive internal scanning infrastructure, making it difficult for smaller organizations to replicate.

Google intends to further enhance PageBreak by connecting it with CodeMender, an agent designed to automatically generate fixes for identified bugs. This integration aims to streamline the patching process, allowing engineers to review and approve proposed solutions rather than starting from scratch.