Loading story…
Google reported that PageBreak, its internal AI security agent primarily powered by Gemini models, discovered more than 500 verified cross-site scripting (XSS) vulnerabilities across its first-party web applications. The agent combines LLM-driven discovery with deterministic validators that execute real exploit payloads before escalating findings to engineers, producing what Google describes as a near-zero false-positive rate. Notable discoveries included JavaScript cache poisoning, an administrative-console exploit chain that bypassed signature-based protection, and universal XSS involving the Tag Assistant Extension. The activity was defensive testing, not a confirmed intrusion; Google found no evidence of attacker exploitation of the cache-poisoning flaw.
PageBreak's validators cover XSS, SQL injection, path traversal, remote code execution, and server-side request forgery, although incomplete validators can miss genuine vulnerabilities. As of September 4, Google reported only two XSS issues among hundreds of applications using its high-assurance web frameworks, both confined to internal applications or debug endpoints with hardening gaps. Google plans closer integration with automated remediation initiatives, including CodeMender, while retaining engineer review of proposed fixes. The findings reinforce the value of verified exploit evidence and secure-by-design frameworks, rather than relying on unvalidated AI findings alone.
See affected versions and whether adversaries are exploiting it.
7 events from the most recent confirmed update back to the earliest known activity.
Google expanded PageBreak from a pilot into a fully fledged project focused on scaling vulnerability discovery and reducing manual triage through deterministic exploit validation.
Google Product Security began piloting PageBreak, an internal AI agent for discovering and validating vulnerabilities in Google's first-party web applications.
Google reported that PageBreak had discovered more than 500 verified XSS vulnerabilities across its first-party web applications, including sensitive domains. Findings were validated through real payload execution before escalation to product teams.
As of September 4, 2026, PageBreak had identified two XSS vulnerabilities among hundreds of applications built with Google's high-assurance web frameworks. Both affected internal applications or debug endpoints with hardening gaps; the individual discovery dates were not stated.
PageBreak demonstrated an exploit chain combining weak external-connection checks, recovery of a one-time nonce, and unsafe message forwarding in the Tag Assistant Extension. Support for data URLs enabled attacker-controlled JavaScript to execute on a page under debugging.
PageBreak identified an XSS chain at admin.google.com involving an unsafe redirect in /a/autodns/registrar. It found that /a/autodns/authorize could generate a valid signature for a malicious JavaScript URI, overcoming the signature protection that initially prevented exploitation.
PageBreak discovered that an unchecked URL path segment entered returned JavaScript but was excluded from the cache key, allowing poisoned responses to reach other visitors in the same geographic area. The flaw could have enabled XSS on Google domains and external sites loading the script; Google found no evidence of attacker exploitation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
cyberaccord.com
Open sourcecryptika.com
Open sourcecybersecuritynews.com
Open sourceblog.google
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google said expanded use of AI across Chrome’s security workflow helped it identify and remediate **1,072 security bugs** in Chrome 149 and Chrome 150, a total that exceeded the number fixed across the prior 23 Chrome milestones combined. The company said large language models and Gemini-based systems are now being used for vulnerability discovery, reproduction, severity assessment, bug routing, patch generation, test creation, code review, and update delivery. Google also said AI-assisted analysis uncovered a **sandbox escape** flaw that had existed for more than 13 years and could have allowed a compromised renderer to access local files. Google attributed the spike in fixes to improved detection rather than a decline in Chrome security, describing AI as a way to scale vulnerability hunting and preemptive remediation across a massive codebase. To shorten the window between patch creation and user protection, the company is piloting twice-weekly security releases and developing dynamic patching and less disruptive automatic restart mechanisms. Google also said it is expanding memory-safety efforts such as **MiraclePtr**, moving new components to **Rust**, scanning code changes with AI before merge, and improving third-party component update pipelines.
Aug 6, 2026
Google and Wiz launched **Scan for Good**, an AI-assisted vulnerability-discovery initiative for critical infrastructure, public services, nonprofits, and technology providers. Using Gemini 3.8 Flash Cyber and Wiz Red Agent, the program identified serious, previously unexploited weaknesses at hospitals, a public rail operator, a municipality, and a national archive. Reported findings included leaked rail-administrator sessions, unrestricted control over a hospital mobile-alert channel, a hospital booking-site upload flaw that could enable server takeover and patient-data exposure, and exposed records affecting roughly 5,000 elderly residents. Other remediated issues included administrative access to 8.8 million national-archive files and a cloud-provider credential that could have allowed alteration of more than 500 production container images. Google also cited an autonomously identified critical GitHub Actions script-injection flaw in Snowflake's `snowflake-connector-net` repository, which Snowflake fixed on the day of disclosure. Google said testing is conducted only with explicit authorization or under applicable disclosure and bug-bounty programs, with human researchers validating findings and coordinating remediation; CISA endorsed the defensive-discovery approach while Wiz cautioned that AI can also accelerate malicious attack-path development.
Sep 24, 2026
Google-owned Mandiant disclosed an internal AI-assisted vulnerability discovery platform, the **Agentic Vulnerability Discovery Harness (AVDH)**, saying it identified more than 100 verified high-severity software flaws in two days during a live investigation tied to stolen corporate repositories. Mandiant said the system has been used internally for about ten months, scanned tens of millions of lines of code, and produced tens of thousands of findings, including dozens of assignable vulnerabilities affecting widely used web extensions and open-source projects. Mandiant said the work has already led to 12 assigned CVEs, including `CVE-2026-13242` and `CVE-2026-55803`, with roughly another dozen cases still in coordinated disclosure. The company described AVDH as a pipeline of specialized AI agents handling threat modeling, entry-point discovery, context enrichment, hypothesis generation, and validation, while stressing that human analysts still review threat models and manually reproduce exploits before findings are accepted. To reduce false positives, agents are designed to challenge one another’s conclusions and apply consultant-authored rules by language, framework, and vulnerability type; Mandiant also said it evaluated the system on synthetic intentionally vulnerable codebases rather than public benchmarks to avoid model-training contamination.
Aug 19, 2026