Google has introduced PageBreak, an autonomous AI agent developed by its Product Security team to identify exploitable vulnerabilities in the company's web applications. The system, which utilizes Google's Gemini models, was piloted in November 2025 and became a full-scale project in January 2026.
Unlike many AI tools that generate inaccurate bug reports, PageBreak includes a specialized validator. This component attempts to exploit identified flaws in a live environment to confirm their validity before alerting human engineers. The agent has already detected over 500 XSS vulnerabilities.
The system demonstrated the effectiveness of secure coding frameworks, finding only two vulnerabilities in applications built on Google's high-assurance platforms. Google noted that PageBreak relies on its unique, massive unified code repository, making the approach difficult for smaller firms to replicate.
Looking ahead, Google plans to integrate PageBreak with CodeMender, an automated patch-writing agent. This integration aims to provide engineers with confirmed vulnerabilities alongside ready-to-review fixes, further reducing the manual effort required for security maintenance.
