Google disclosed that its PageBreak AI security agent has uncovered more than 500 cross-site scripting vulnerabilities across the company's web applications. The system tests suspected flaws against live applications before forwarding reports to product teams. PageBreak employs Gemini models for the majority of scans and uses separate validation tools to verify whether an exploit is functional. Applications built on Google's high-assurance frameworks contained two XSS findings as of September 4. Google intends to integrate PageBreak more closely with CodeMender, which generates security patches. The Google Product Security team noted that PageBreak originated as a pilot in November 2025 and transitioned to a formal project in January 2026. It evaluates Google's own web services and has detected cross-site scripting flaws even on sensitive internal domains. The company did not specify the affected applications. Cross-site scripting, or XSS, arises when an application permits an attacker's script to execute in a user's browser. Depending on the application and the attacker's access level, the flaw may expose data or enable session hijacking. Google reported over 500 findings across its applications but did not provide a breakdown by product or severity. Validation occurs through a dedicated step that injects a JavaScript payload, loads the affected page, and checks script execution. This process has maintained a false positive rate near zero. The agent also assesses other vulnerability types, such as database query injection, path traversal exposures, and unauthorized access to internal services. Separate checks examine whether applications transmit requests to internal services. Rather than submitting every suspected bug to product teams, PageBreak routes each candidate to a specialized validator. For XSS cases, the validator inserts a payload, loads the page, and confirms script execution. Google stated that this validation step has kept false positives minimal. The system can also test additional flaw categories. Validators are not authored by the AI agent; they are pre-existing components. Google sometimes runs agents through multiple iterations because models may pursue unproductive paths before identifying viable exploits. The validation workflow was developed in response to a challenge faced by security staff: AI-generated reports can describe plausible attack sequences that fail during testing. Under PageBreak's protocol, unverified candidates remain within the security team's workflow. They may inform future scans or assist engineers in building new validators, but Google emphasized they are not presented to product teams as confirmed vulnerabilities. Within protected applications, PageBreak identified two XSS flaws as of September 4, according to Google. Both were limited to internal applications or debug endpoints lacking sufficient security controls. The findings pertain to this category of applications; the overall count of over 500 reflects first-party web applications more broadly. This framework enables Google to evaluate how its application architecture withstands repeated scanning. PageBreak also accesses internal tools that allow inspection at scale. Google noted that its code repository enables the agent to traverse service boundaries, while live web traffic data links requested pages to relevant source code. Existing scanners provide authenticated access to internal sites that external researchers might struggle to reach. These resources help explain the scope of Google's findings without implying that external parties could replicate the results solely by running a Gemini model. The reported count derives from scans of Google's applications that include access to code, traffic data, and testing infrastructure. The challenge of validating AI-generated security reports is not unique to Google. In July, the Ethereum Foundation described a similar process in which agents propose potential findings and independent reviewers attempt to reproduce them. The foundation documented one confirmed flaw in libp2p, later assigned CVE-2026-34219, while cautioning that plausible reports may reference unreachable code or impractical attack conditions. For organizations managing cryptocurrency user funds, distinguishing between a candidate issue and a functional exploit influences response timelines. An August Bitcoin Red Team assessment logged 7,958 findings across 501 open-source projects after 108 hours. Of these, 24.7% had reproducible proofs; the total did not indicate 7,958 exploitable vulnerabilities. Earlier analyses of crypto bug bounty programs revealed comparable review burdens. Cosmos Labs co-CEO Barry Plunkett noted in April that program submissions had increased by 900% year-over-year, encompassing both valid and invalid reports. PageBreak is an internal Google tool, and the company has not indicated plans to make it available to external projects. To reduce the volume of unverified findings reaching product teams, Google is strengthening ties with CodeMender, which generates automated fixes. This integration aims to allow product teams to review proposed remedies alongside confirmed vulnerabilities. The validation process helps maintain a low false positive rate while enabling thorough assessment of potential security issues across Google's infrastructure.