Agentic Hacks, Real Proofs: Inside Google's PageBreak Project

Evidence record

First-party technical and operational account by Google information security engineer Michal Bentkowski. Describes the November 2025 pilot, January 2026 project, Gemini usage, non-AI-written exploit validators, Google-reported 500-plus XSS tally, limited coverage, high-assurance-framework subgroup and internal infrastructure. Aggregate results are vendor-reported, not independently replicated.

Read the original source ↗

Claim-level citations (10)

• supportsGoogle PageBreak tests AI-found web vulnerabilities with executable proof: Google says PageBreak can use several models but relies predominantly on Gemini, including Gemini 3.1 Pro and Gemini 3.5 Flash, to search its own first-party web applications.

  Security landscape in 2026, paragraph beginning "While PageBreak is flexible"

• supportsGoogle PageBreak tests AI-found web vulnerabilities with executable proof: Google states that its Product Security team began piloting PageBreak in November 2025, formalized it as a project in January 2026, and disclosed its approach publicly on September 24, 2026.

  Byline and publication date; Security landscape in 2026, paragraph beginning "PageBreak is an internal AI agent"

• supportsGoogle PageBreak tests AI-found web vulnerabilities with executable proof: PageBreak forwards a vulnerability candidate as a verified report only after specialized, security-engineer-written, non-AI validators execute a real exploit check against a running environment; unverified hypotheses are retained for future investigation rather than reported as proven bugs.

  How Agent Validators Work, first two paragraphs and XSS example; Internal Feedback Loop: Non-Deterministic Findings, final paragraph

• supportsGoogle PageBreak tests AI-found web vulnerabilities with executable proof: Google reported that PageBreak had uncovered more than 500 cross-site scripting vulnerabilities across Google first-party web applications by the September 24, 2026 disclosure; the number and near-zero false-positive description are Google-reported results rather than independently reproduced measurements.

  Security landscape in 2026, paragraphs beginning "Early on in the development" and "Proceeding this way"

• supportsGoogle PageBreak tests AI-found web vulnerabilities with executable proof: Google acknowledges that deterministic PageBreak validators cannot currently cover every vulnerability type or complex exploit scenario. Unverified candidates are retained as research seeds and validator-development feedback instead of being delivered to product teams as confirmed bugs.

  Internal Feedback Loop: Non-Deterministic Findings, opening paragraph and three bullets through the closing paragraph on unverified reports

• supportsGoogle PageBreak tests AI-found web vulnerabilities with executable proof: Google reported that, as of September 4, 2026, PageBreak had found two XSS vulnerabilities across hundreds of applications using its high-assurance web frameworks; both were in internal applications or debug endpoints with hardening gaps.

  PageBreak vs a High-Assurance Framework, paragraph beginning "When put to the test"

• supportsGoogle PageBreak tests AI-found web vulnerabilities with executable proof: Google says it runs agents with identical seeds across multiple iterations because a model can follow unproductive paths, an attempt to increase the chance of discovering a valid exploit trajectory rather than a guarantee of complete coverage.

  The present and the future, paragraph beginning "Even with such tooling, models can still deviate"

• supportsGoogle PageBreak tests AI-found web vulnerabilities with executable proof: Google identifies its monorepo, live-traffic-to-code security signals and authenticated web scanning infrastructure as important advantages for PageBreak that may not transfer to organizations without comparable access.

  The present and the future, paragraphs on Google Mono-Repo, Security Signals and Existing scanning infrastructure

• supportsGoogle PageBreak tests AI-found web vulnerabilities with executable proof: Google describes separate deterministic validators for XSS using browser-observed JavaScript execution, SQL injection using response or timing changes, path traversal using a planted-file read, remote code execution using delays, file writes or network signals, and SSRF using observed internal requests. These are described validation capabilities, not a five-class breakdown of its reported XSS tally.

  How Agent Validators Work; the five bullets headed XSS, SQL Injection, Path Traversal, Remote Code Execution (RCE), and Server-Side Request Forgery (SSRF)

• supportsGoogle PageBreak tests AI-found web vulnerabilities with executable proof: Dark Reading reported that the three publicly illustrated PageBreak flaws had been fixed, but said the repair status of all reported findings remained unknown; Google describes deeper integration with its CodeMender automated fixing initiative as future work.

  The present and the future, final two paragraphs discussing CodeMender collaboration and plans