Google PageBreak Makes AI Prove the Exploit Before Raising the Alarm

Google says its internal PageBreak security agent found more than 500 cross-site scripting vulnerabilities across first-party web applications while producing a near-zero false-positive rate. The differentiator is a proof-first workflow: models propose attack paths, but specialized non-AI validators execute controlled payloads against running environments before a finding reaches a product team. That pattern could make AI security scanning more useful, though PageBreak is not a public product and Google's internal access gives it advantages most teams cannot reproduce.

Many AI scanners stop after generating a plausible code explanation. PageBreak tries to close the loop. Its validators check whether JavaScript executes, database behavior changes, a protected file can be read, code execution produces an observable effect, or a server makes an unintended request. An alert is promoted only when the system can produce concrete exploit evidence.

Security teams pay for false positives twice: first in triage time and again when noisy tools lose developer trust. A validator converts a model's hypothesis into a repeatable test with an explicit pass or fail condition. It also creates a stronger handoff artifact—affected path, payload, observed result, and reproduction environment—than a fluent explanation alone.

PageBreak still retains nondeterministic candidates, but Google says it does not send them to product teams. Instead, those candidates seed later investigations, reveal missing environment access, and help engineers decide which new validators to build. This creates a disciplined backlog without presenting unverified model output as a confirmed vulnerability.

Google reports more than 500 XSS discoveries and near-zero false positives, but it has not published the denominator, recall, severity distribution, duplicate rate, review cost, or independent reproduction rate. A proof-only queue can also miss flaws when no validator exists. Low false positives therefore do not establish high coverage.

PageBreak can traverse Google's monorepo, map live traffic to source, authenticate to internal applications, and reuse mature scanning infrastructure. Those privileges help it follow vulnerabilities across services and verify behavior in realistic environments. A company with fragmented repositories, incomplete test environments, or weak asset identity should not assume the same results from the same model.

The transferable idea is to fund validators before buying more detection volume. Start with a narrow vulnerability class and a disposable, production-like environment. Require an executable proof, capture every side effect, separate confirmed findings from research leads, and measure analyst minutes per accepted vulnerability. Keep destructive payloads, credentials, and network egress bounded.

Seed known vulnerabilities and hard negatives in an isolated application. Measure recall, confirmed precision, time to proof, duplicate findings, validator coverage, unsafe actions, compute cost, reviewer effort, and patch acceptance. Run conventional scanners in parallel. Do not give an experimental agent unrestricted production credentials merely because it is designed to find security defects.

PageBreak's real contribution is an operating principle: AI-generated security claims should earn trust through executable evidence. The approach can reduce noise and improve prioritization, but organizations still need isolation, least privilege, human review, recall measurement, and secure remediation.