Agentic Hacks, Real Proofs: Inside Google's PageBreak Project

What it is

PageBreak is Google Product Security's internal agentic vulnerability scanner, piloted November 2025 and operating as a full project since January 2026. It runs mostly on Gemini 3.1 Pro and Gemini 3.5 Flash against Google's first-party web applications.

How it works

The agent generates vulnerability hypotheses, then passes each to a non-AI, deterministic validator that executes a real payload to confirm exploitability before anything reaches a product team. Validator mechanics differ by bug class:

• XSS: injects a JS payload and uses a rendering harness to check if it actually executes.
• SQL injection: injects payloads and checks output/timing for signs of query manipulation.
• Path traversal: writes a file to a world-readable location and checks if the app can read it back.
• RCE: tries sleep-delay timing, writing to a world-writable location, or triggering outbound DNS/HTTP requests.
• SSRF: checks whether an outbound request to an internal backend service was actually triggered.

Findings the validators can't confirm aren't discarded: they're fed back in as seeds for deeper scans in later runs, used to guide new validator development, and the agent is allowed to report what access/capability it lacked to validate a finding. Unverified findings are never sent to product teams. To reduce path-dependent misses, PageBreak runs agents with identical seeds across many iterations rather than relying on a single trajectory. Google-specific advantages cited: a mono-repo letting the agent trace execution end-to-end without external lookups, HTTP-traffic-derived "security signals" mapping live paths to source lines, and reuse of an existing internal scanner already authenticated against nearly every Google web app.

Preconditions / Affected

Applies to Google's first-party web apps, including sensitive/internal domains and debug endpoints. As of September 4, 2026, apps built on Google's high-assurance web framework (described in Google's 2025 "Secure by Design" post) had only 2 confirmed XSS findings across hundreds of apps, both in internal or debug-endpoint contexts with hardening gaps — versus 500+ XSS bugs found elsewhere.

flowchart LR
    A[Agent hypothesis] --> B{Deterministic validator confirms?}
    B -->|Yes| C[Sent to product team]
    B -->|No| D[Unverified finding]
    D --> E[Seeds deeper scans]
    D --> F[Guides new validator dev]

What to do

No external action items — this is Google's internal tooling, not a released scanner or advisory. Google states plans to integrate PageBreak with its CodeMender auto-fix agent so product-team involvement shrinks to approving generated fixes.

Caveats

Google acknowledges validators don't yet cover all vulnerability classes or complex scenarios, creating a risk of false negatives for bugs a non-deterministic approach might have caught. The near-zero false-positive claim rests on Google's own usage data, not independent verification. Technical exploit details (e.g., a cache-poisoning/crypto-bypass case) live in a separate companion post, not in this article.