Google Uses AI To Hack Its Own Web Apps And Validate More Than 500 XSS Vulnerabilities

Google Trained an AI to Break Into Its Own Websites, and It Found More Than 500 Holes

Google has pointed one of its artificial intelligence agents at its own web applications and told it to break in.

The result, an internal tool called PageBreak, has confirmed more than 500 cross-site scripting (XSS) vulnerabilities in the company's first-party apps.

The same tool found just two such flaws across hundreds of apps built on Google's high-assurance web frameworks.

Google's Product Security team revealed the project on 24 September 2026 in a blog post by information security engineer Michał Bentkowski.

What Is Cross-Site Scripting and Why Does It Matter?

XSS happens when an attacker manages to slip a script into a web page that another person then loads.

Depending on the app, that script could read private data or take over a victim's logged-in session.

It is one of the oldest and most persistent problems in web security, which is why Google chose it as a proving ground for automated hunting.

How Does PageBreak Tell Real Bugs From AI Guesswork?

Google describes PageBreak as an agent built to test the security of its first-party web applications.

The company said,

"Starting as a pilot in November 2025 and moving to a fully-fledged project in January 2026, its mission is to autonomously scale vulnerability discovery while minimizing manual toil."

The tool runs in two stages.

First, a Gemini model looks for suspected flaws.

Most scans use Gemini 3.1 Pro and Gemini 3.5 Flash, although other models can be swapped in.

Each suspicion is then passed to a purpose-built validator, which fires a real attack at a running copy of the application.

For an XSS claim, the validator injects a JavaScript payload, loads the page and checks whether the script actually executes.

A bug is confirmed only if the exploit works.

Beyond XSS, the validators test whether injected input can change database queries, expose files through path traversal or trigger code execution.

A separate validator examines requests that could reach internal services.

Because models can drop a promising lead or chase one that fails in real conditions, Google runs the same starting point several times, giving the agent repeated chances to find a working exploit.

Why Is Google Worried About "AI Slop"?

The company is blunt about the problem it wants to fix.

Security teams have been swamped with reports from AI tools acting as code analysers, many of them unverified guesses.

Google wrote,

"Distinguishing a genuine, exploitable flaw from a convincing hallucination has become a major challenge."

PageBreak's validation step is its answer.

Google says the false-positive rate is near zero.

Candidates that fail validation never reach product teams as confirmed bugs.

They are fed into later scans or used by engineers to build the next validator, all within the security workflow.

What Do the Two Hardened-Framework Bugs Tell Us?

The most striking figure is the gap.

As of 4 September 2026, PageBreak had counted only two XSS flaws among hundreds of apps built on Google's high-assurance frameworks.

Both sat in internal apps or debug endpoints that had not been fully hardened.

Google reads the difference, more than 500 findings against two, as proof that safe-by-design frameworks can hold up against a relentless automated attacker.

The argument is that building software correctly from the start removes whole classes of bugs, rather than leaving teams to patch them afterwards.

Google did not name the affected apps or give a severity breakdown for the 500-plus findings.

Can Other Companies Copy This Approach?

Not easily, according to Google.

PageBreak benefits from infrastructure that outside researchers do not have.

A single code repository spanning billions of lines lets it trace execution paths across services.

Live-traffic security data links a page request back to its source code, and existing scanners give the agent logged-in access to internal sites that are otherwise hard to reach.

Google has not said whether PageBreak will be offered to external projects.

What Happens After a Bug Is Confirmed?

Google plans to connect PageBreak more closely with CodeMender, its fix-writing agent, so that engineers can review a proposed patch alongside each confirmed vulnerability.

No timetable has been given.

CodeMender was also mentioned in May, when Google's Threat Intelligence Group said it had caught what it believed was the first zero-day exploit created with AI assistance.

Is Verifying AI Security Findings a Wider Problem?

Yes, the challenge of checking AI-generated security reports extends well beyond Google.

The Ethereum Foundation has used separate reviewers to reproduce findings made by AI agents.

It reported one confirmed flaw in libp2p, later disclosed as CVE-2026-34219, while warning that plausible reports can involve unreachable code or attack conditions that do not hold in practice.

In August, a Bitcoin Red Team sweep of 501 open-source projects produced 7,958 findings over 108 hours, yet only 24.7% had reproducible proofs at the time, so the total did not amount to 7,958 confirmed vulnerabilities.

How Does This Fit Into the Rise of AI-Driven Attacks?

Concern about AI-enabled cyberattacks has grown through the year.

In August, more than 100 organisations, including Google, Microsoft and Anthropic, signed an open letter warning that such attacks are becoming more common.

Autonomous agents have also been found to breach real companies during testing, and an AI agent configured by OpenAI was reported to have accessed an Australian government website without authorisation in June.

PageBreak sits on the defensive side of that picture, with an AI working to catch the bugs before someone else does.