Google PageBreak tests AI-found web vulnerabilities with executable proof

Google disclosed PageBreak as an internal, authorized AI-assisted security research system, not as an AI attacking unrelated users. Its operational distinction is the evidence gate between a plausible model-generated exploit hypothesis and a bug report that a product team should act on. The agent can explore first-party web applications and propose candidates, while security engineers maintain executable, non-AI-written validators outside the model loop. A candidate is forwarded as verified only when an appropriate validator confirms the behavior against a running application.

The validators test observable effects instead of trusting the model's explanation. Google describes browser instrumentation checking that injected JavaScript executes for XSS; response or timing checks for SQL injection; a planted file read for path traversal; delay, file-write or outbound network signals for remote code execution; and detected internal service requests for server-side request forgery. These examples describe validation capabilities across classes, not 500 confirmed findings in every class. The published aggregate tally is specifically more than 500 XSS findings, and Google calls the confirmed-report false-positive rate near zero. Both figures remain vendor-reported, without a public independent inventory or comparable false-negative measurement.

PageBreak team member Lukas Weichselbaum supplies concrete examples of why source-code and backend context matter. He describes an admin.google.com endpoint that checked server-generated signatures: PageBreak reportedly traced a second endpoint able to sign a javascript: URL and combined the endpoints into an XSS chain. He also names JavaScript cache poisoning on apis.google.com and universal XSS in the Tag Assistant extension. These are first-person team reports, not payloads reproduced independently for this dossier; the separate Google Bug Hunters walkthrough was linked but its body was inaccessible through the research browser.

A validator also imposes a detection boundary. Google explicitly acknowledges that unsupported vulnerability types and complex paths may escape deterministic checks. Rather than send unproven suggestions to product teams, PageBreak keeps them as possible seeds for later scans and feedback for validator development. Google further says it repeats runs with identical seeds to reduce the chance that a single unproductive model trajectory determines the outcome. Neither repeated runs nor high precision establish complete vulnerability coverage.

The apparent difference between more than 500 XSS findings overall and two among hundreds of applications using Google's high-assurance framework as of September 4, 2026 is not a comparable rate: Google reports the two subgroup findings in internal or debugging surfaces, but it does not provide aligned denominators, app mix or equal exposure windows. PageBreak also benefits from Google-specific monorepo visibility, mapping from live traffic to code and authenticated scanning infrastructure. Dark Reading says three publicly described issues had been fixed, while full remediation of the wider tally remains unestablished; Google describes deeper CodeMender integration as a plan, not a completed universal fix. Authorized verification is not evidence of attacks in the wild.