Google’s internal security agent has reported more than 500 cross-site scripting flaws across its own web applications since reaching full operation in January, according to a paper the company published this week.
The system runs on Gemini models and goes by the name PageBreak. Its distinguishing feature is not the model underneath but the gate in front of the report: every hypothesis must be reproduced against a running application before anyone hears about it.
Proof before paperwork
An engineer watching the agent propose an injection simply executes JavaScript against a live service. A path traversal has to write to a world-readable location. Remote code execution has to trigger outbound DNS.
Michal Bentkowski, the Google security engineer who documented the design, said the team chose deterministic validation early. Product groups, he explained, get buried by plausible-sounding bug reports, so nothing ships to them without a reproducible exploit.
The validators are ordinary code written by security engineers and kept outside the agent loop, which is why unverified candidates cannot promote themselves. Google still keeps those loose ends internally to seed deeper scans and spot gaps in its own checkers.
The blind spot Google admits
That discipline has a price. Google acknowledges its validators do not yet cover every vulnerability class, and a flaw the checkers cannot express becomes a false negative the model was never allowed to flag.
The longer plan points at CodeMender, another Google agent, so that PageBreak’s findings can arrive with a generated fix attached. No outside party has audited the 500-plus figure yet.
