Google's AI Agent Discovers Over 500 XSS Vulnerabilities

Google has announced in a research paper the development of an AI-powered security agent called 'PageBreak' that has discovered over 500 XSS vulnerabilities in the company's web applications. XSS (Cross-Site Scripting) is a technique where attackers embed malicious scripts into web pages to execute them on users' browsers. PageBreak began full operations in January 2025, and the detected vulnerability count represents those discovered since then.

Traditionally, security testing of web applications has been conducted either through manual work by experienced engineers or by relying on pattern-matching automated tools. However, both approaches have been recognized as having limitations in responding to complex applications and new attack patterns. While efforts to incorporate AI agents into vulnerability discovery have increased in recent years, false positives—alerts issued when no actual problem exists—are frequently cited as a precision challenge.

PageBreak is built around Google's AI model 'Gemini' and incorporates a mechanism to autonomously investigate vulnerability candidates. However, a determination by the AI that something is suspicious does not immediately result in a report. Instead, the design requires that attack scenarios be reproduced against a live running application, and only when a deterministic validator successfully reproduces the attack is a report generated. This two-stage confirmation process becomes key to suppressing false positives.

The significance of this mechanism extends beyond the sheer number of vulnerabilities discovered. The two-layer structure of 'AI finds candidates and deterministic methods provide verification' represents a design that combines AI's flexible exploratory capability with the certainty of conventional tools. In the security field, high false positive rates can erode practitioners' trust and cause tools to fall into disuse. Accordingly, the decision to embed precision-assurance mechanisms is an important design choice for operational deployment.

Google's decision to publish PageBreak's details as a research paper is also noteworthy. Publicly demonstrating the company's security achievements serves as design reference information for the research community and industry peers, while also promoting standardized discussion of AI-powered security techniques. Whether similar approaches will see broader adoption across the industry remains an observation point going forward.

The trend of AI agents being formally integrated into security testing is expected to continue. Within this context, the critical measure becomes not simply 'how many vulnerabilities were found' but rather the actual effectiveness: how much do discovered vulnerabilities contribute to reducing real-world risk? PageBreak's approach may serve as a reference case for establishing such evaluation criteria.