Google's new AI tool, PageBreak, has identified over 500 security vulnerabilities in its applications, aiming to enhance security detection.
Summary
- Google has launched PageBreak, an AI developed by its Product Security team, which has already uncovered over 500 security vulnerabilities.
- This tool effectively validates vulnerabilities by confirming them through successful exploitation, achieving a minimal false-positive rate.
- Google plans to integrate PageBreak with CodeMender, its automated bug-fixing system.
Google has unveiled PageBreak, a new AI tool designed to identify security vulnerabilities within its web applications. Announced on September 24, this initiative stems from the Product Security team and aims to enhance the detection of exploitable weaknesses with minimal human intervention.
According to Michał Bentkowski, an information security engineer at Google, PageBreak is an autonomous agent specifically crafted to test the security of Google’s applications. The goal is straightforward: to accurately identify real security threats while minimizing false alarms.
The AI will begin a pilot phase in November 2025 and is set to transition to full operation by January 2026. Google emphasized that the tool aims to reduce the manual effort associated with vulnerability detection, which has become increasingly challenging due to the prevalence of misleading AI-generated bug reports.
Google described this phenomenon, termed "AI slop," as a significant obstacle for security teams inundated with low-quality reports that appear credible but are ultimately inaccurate. PageBreak seeks to mitigate this issue by verifying potential vulnerabilities before they are reviewed by humans.
Using Google's Gemini models, PageBreak detects a flaw and forwards it to a specialized validator that attempts to exploit it in a live environment. So far, the AI has identified over 500 cross-site scripting (XSS) vulnerabilities, which could allow attackers to hijack sessions or steal sensitive information.
When tested against applications built on Google's secure frameworks, PageBreak found only two vulnerabilities, underscoring the effectiveness of building secure software from the outset rather than relying on post-discovery patches.
The urgency for enhancing AI security measures has grown, especially following an open letter signed by over 100 organizations, including Google, warning about the increasing risk of AI-driven cyberattacks. This comes in light of incidents where AI agents from major firms breached actual companies during testing.
In contrast to these security breaches, PageBreak represents a proactive initiative. Rather than enabling exploitation, it focuses on identifying vulnerabilities beforehand. Google has previously encountered issues when one of its AI tools was compromised, allowing attackers to execute harmful code.
While PageBreak leverages resources that many smaller companies may not have—such as access to vast code repositories—its next phase will involve integration with CodeMender, Google’s automated patch-writing system. This will facilitate the submission of confirmed vulnerabilities along with proposed fixes, streamlining the review process for engineers.
