[tl;dr sec] #348 - Google's PageBreak Scanner, Perplexity's Agent Security Tool, Defending Agentically

What it is

Issue #348 of the tl;dr sec newsletter (Clint Gibler) links to a set of write-ups. Several carry actionable specifics beyond the existing summary: Google's PageBreak design, Numbat's rule model, and defender guidance on agent noise, defensive automation and Scaleway IAM.

How it works

PageBreak (Google, Michał Bentkowski). The agent has found over 500 XSS bugs in Google's first-party web apps since November 2025, mostly using Gemini 3.1 Pro and 3.5 Flash, with near zero false positives. Every hypothesis goes to a validator that fires a real payload at a running environment:

• XSS: inject JavaScript and watch whether it executes.
• Path traversal: write a file in a world-readable location.
• RCE: trigger outbound DNS.

Findings that cannot be confirmed deterministically become seeds for deeper inspection in later scans and guide the development of new validators. Bentkowski credits three things for its effectiveness: a mono-repo that lets the agent trace execution end to end, live HTTP traffic mapped back to source lines, and an existing scanner that authenticates to nearly every Google application. Against hundreds of apps built on Google's high-assurance web framework, it found only two XSS bugs, both in internal apps or debug endpoints with hardening gaps. A second post covers three high-severity cases: a cache poisoning bug, an XSS in admin.google.com, and a UXSS in the Tag Assistant Extension.

Numbat (Perplexity, open source). A Go binary for macOS, Linux and Windows. It hooks into agent harnesses (Claude Code, Codex, OpenCode, Pi) to block risky actions before they run, rebuilds timelines from session artifacts, and exports OTLP telemetry. It ships 52 built-in rules written as CEL expressions over normalized events. Some rules detect sequences, for example a secrets manager read followed by a curl upload, because either action alone can be legitimate. Perplexity deploys it on every endpoint through MDM. Detections go to Perplexity Computer, which investigates each one and drafts new rules for the security team to review.

Detection fidelity (Julien Vehent). Tripwire detections on rare actions break when agents run curl, tcpdump and throwaway Python scripts all day. In the Hugging Face incident, sensors caught the activity but never paged anyone because each action looked like normal workload behavior. Together the signals indicated an intrusion: credentials used from several environments, workloads minting tokens they had never touched, and more than 180 VPN enrollments.

What to do

Recommendations stated in the newsletter's summaries of the underlying posts:

• Vehent: score each signal for confidence and alert when the combined score crosses a threshold along the attack chain. Give every agent its own identity, test that escalation actually reaches a human, and block agents from the cloud metadata service to cut noise.
• Scaleway (Tom De Keyser): prefer application keys over user keys, because a user principal API key impersonates the person and a leaked one means full account takeover. Guard the plaintext CLI config file and assume Organization and Project metadata is effectively public. Even a policy-less key leaks metadata and permissions.
• NCSC (Dave Chismon): score each defensive action on potency, scope, criticality, rollout confidence and recoverability, then automate the lowest-risk ones first. Low-potency tasks that "advise a human", such as summarizing threat intelligence, are the easy starting point.
• Casey Ellis (Bugcrowd): inventory legacy systems, assume compromise wherever visibility is missing, and update incident response plans older than a year. Ellis cites Volt Typhoon hiding in router firmware, abandoned middleware and unpatchable Windows XP machines.
• Cilium users: SpecterOps' CiliumHound (Andrew Luke) ingests a folder of JSON or YAML policies into a BloodHound OpenGraph graph, with saved Cypher queries such as finding egress rules without L4 port restrictions.

Caveats

• Chismon says proving an action is low risk before it runs is the unsolved part, for example showing conclusively which network calls a system could ever make.
• Wiz's Scan for Good (Wiz Red Agent plus Gemini 3.8 Flash Cyber) reports about 475 High or Critical disclosed findings in critical infrastructure, nonprofits and public services. The newsletter gives no methodology or false-positive rate.
• PageBreak's results depend on Google's mono-repo, traffic-to-source mapping and its authenticated scanner. The newsletter does not say whether the approach carries over without them.
• The issue relays each source in a few paragraphs, with commentary. Rule lists, install steps and query text are in the linked posts, not here.