Google's PageBreak AI Agent Finds 500 Flaws in Its Web Apps

Google's Product Security team deployed PageBreak, an AI-driven agent that identified over 500 XSS and related vulnerabilities in first-party web applications; the tool pairs LLM-generated hypotheses with deterministic, non-AI validators that execute real payloads to confirm exploits and reduce false positives, and several issues (e.g., cache poisoning on apis.google.com and XSS on admin.google.com) were fixed, with plans to integrate PageBreak findings into automated fix generation via CodeMender.