News · curated 6 Oct 2026
Google's PageBreak AI Agent Finds 500 Flaws in Its Web Apps
First reported darkreading.com
Coverage timeline
Single-source incident — first reported, latest, and curated coincide.
Why it matters
PageBreak illustrates how agentic AI is being operationalized for autonomous vulnerability discovery at scale, a trend defenders should track as both a defensive capability and a sign of where automated offensive tooling is heading.
Google revealed PageBreak, an internal AI agent built by its Product Security team that combines AI with deterministic validation to autonomously discover and triage vulnerabilities in the company's first-party web applications. The agent has found more than 500 cross-site scripting flaws, plus issues like cache poisoning in apis.google.com and an XSS flaw in admin.google.com, all since fixed.