Over the past two years, more and more businesses have used AI to scan code for security flaws, and it is undeniably much faster than doing it by hand. Yet many security teams quickly ran into another problem: a large share of the reports AI produces are unverified guesses, or even convincing-sounding hallucinations. Teams sometimes spend more time telling real issues from false ones than they would checking the code themselves. In September 2026, Google described how its internal AI security agent, PageBreak, works: it found more than 500 cross-site scripting (XSS) vulnerabilities across Google's own web applications, with a near-zero false-positive rate. This article explains how PageBreak works, the thinking behind its design, and what smaller businesses can learn from it.
What is PageBreak?
PageBreak is an internal AI agent built by Google's Product Security team to test the security of Google's first-party web applications. It started as a pilot in November 2025 and became a full project in January 2026, with the goal of scaling vulnerability discovery automatically while reducing repetitive manual work. PageBreak can work with different AI models, but most of its usage today runs on Google's own Gemini 3.1 Pro and Gemini 3.5 Flash. Running at large scale, it uncovered more than 500 XSS vulnerabilities across Google's web applications, including on sensitive domains such as admin.google.com, as well as other issues such as a cache-poisoning flaw in apis.google.com. Google says the cases it has published have been fixed.
First: what is an XSS vulnerability?
XSS, or cross-site scripting, is one of the most common website security flaws. Put simply, if a website does not handle user input properly, an attacker may be able to inject a piece of malicious code into a page; when other people visit that page, the code runs in their browsers and can steal login sessions, alter page content or carry out actions while impersonating the user. Because most businesses have a website, online forms or a membership system, XSS is a risk that companies of every size need to take seriously.
The core design: AI suspects, non-AI code proves
What is most worth learning from PageBreak is that Google decided early on to prioritise deterministic validation. The process has two steps. First, the AI agent reads the code and uses security tools to propose a hypothesis that a flaw exists somewhere. Second, that hypothesis is handed to a specialised validator that was not written by AI, which runs a real test against a live environment; only flaws that are successfully proven get reported. Each class of vulnerability has its own validation method: for XSS, the validator injects a specific piece of code and loads the page to see whether it actually executes; for SQL injection, it checks whether query output or response timing has been altered. Because every report comes with real evidence, the false-positive rate is close to zero, and product teams are not buried under unverified reports. As one industry commentator put it, you shouldn't let an agent grade its own homework.
What happens to findings that can't be proven?
Google also acknowledges that its current validators cannot cover every type of vulnerability or every complex scenario, so some genuine issues may be missed. Findings that cannot yet be proven are not sent to product teams. Instead they are used internally: as starting points for deeper inspection in later scans; to reveal where the validators fall short and guide the development of new ones; and by letting the AI agent report which access or capabilities it was missing during validation, which points to future improvements. This keeps the benefit of AI searching at scale without passing unverified noise on to other teams.
Building it secure from the start works best
Another PageBreak finding is just as important. Google had earlier introduced a high-assurance web framework designed to eliminate common web vulnerabilities by default. Under PageBreak's testing, as of 4 September 2026, only two XSS vulnerabilities were found across hundreds of web applications built on that framework, and both were limited to internal applications or debug endpoints. The contrast makes the point clearly: AI scanning is useful, but adopting secure development frameworks and practices at the source is the most effective line of defence. In other words, rather than endlessly patching after the fact, reduce the chance of flaws appearing in the first place.
Next step: from finding flaws to fixing them automatically
Even when only proven vulnerabilities are reported, product teams still receive an unprecedented volume of reports. To address this, Google is connecting PageBreak with another internal project, CodeMender, which generates fixes automatically. Google's aim is to integrate the two further so that product teams ultimately only need to review the fixes AI proposes. This shows AI's role in security extending from "finding problems" to a complete pipeline of finding problems, proving them and proposing fixes, with people focusing on the final judgment and sign-off.
What can smaller businesses learn?
Some of Google's advantages, such as keeping billions of lines of code in a single repository and years of accumulated scanning infrastructure, are not something most companies can replicate. But the principles behind them apply to everyone. First, when using AI to check your website, require every finding to come with reproducible evidence rather than making sweeping changes based on the AI's judgment alone. Second, apply the "AI proposes, another mechanism verifies" idea to other work too: contract clauses drafted by AI should be checked by a person or against rules, and figures calculated by AI should be re-checked with formulas. Third, favour mature, actively maintained website frameworks, content management systems and plugins, and keep them updated, to cut vulnerabilities at the source. Fourth, run regular security checks on your website, online forms and membership systems, bringing in a professional team where needed. Finally, it must be stressed that any vulnerability testing should only be done on systems you own or are authorised to test; never test someone else's website.
Conclusion: AI finds the problems, evidence decides
PageBreak's success is not about how smart the AI is, but about placing it inside a process that demands evidence: AI proposes possibilities at scale, a deterministic validation mechanism decides what is real, and people make the final call. That thinking applies not only to cybersecurity but to every part of how a business uses AI. To learn how to build reliable AI workflows for your company and deploy AI staff into real operations, visit ai.ud.hk to explore UD's AI Staff solutions.
懂AI，更懂你｜UD相伴，AI不冷