Google Built an AI That Hunts Its Own Security Bugs
Google has built an internal AI security agent called PageBreak to find real, exploitable vulnerabilities in its own web apps and reduce noisy, false bug reports. Running on Gemini models, it flags a possible flaw and passes it to a validator that tries to exploit it in a live copy of the application before a human reviews it. Google says PageBreak has already found more than 500 cross-site scripting vulnerabilities in first-party apps, but only two bugs in newer “high-assurance” frameworks designed to prevent such flaws by construction. The project reflects growing concern over AI-driven cyberattacks and the need for tools that can verify, not just imagine, security issues. Google plans to connect PageBreak with CodeMender, an automated patching agent, so confirmed bugs can come with proposed fixes.
