Artificial intelligence is changing not only how organizations build software, but also how they discover and validate security vulnerabilities.
Google has revealed an internal AI security agent called PageBreak that identified and verified more than 500 cross site scripting, or XSS, vulnerabilities across its web applications. The system was designed to go beyond simply identifying suspicious code. It attempted to validate whether a suspected weakness could actually produce a working security impact.
This approach highlights an important development in application security: AI is increasingly being used not just to find potential vulnerabilities, but to reproduce, validate, prioritize, and help security teams address them.
Importantly, the reported activity was part of defensive security testing. It was not a confirmed cyberattack against Google.
Why AI Powered Security Testing Matters
Traditional vulnerability scanners can identify large numbers of potential security issues.
The challenge is determining which findings are actually exploitable.
Large volumes of false positives can consume significant time for security teams. Engineers may spend hours investigating issues that ultimately turn out to have little or no security impact.
PageBreak takes a different approach.
According to the report, the system uses AI to identify potential weaknesses and then passes those findings to specialized validation mechanisms that attempt to demonstrate whether the vulnerability works in a controlled environment.
This creates a more evidence driven security workflow.
Instead of asking only:
Could this code be vulnerable?
Security teams can increasingly ask:
Can this vulnerability actually be demonstrated under controlled conditions?
From Vulnerability Detection to Exploit Validation
One of the most significant aspects of the project is its focus on verification.
For XSS testing, PageBreak can identify a potential injection point and use a browser based testing environment to determine whether attacker controlled JavaScript can actually execute.
The reported validation approach can also be applied to other vulnerability categories, including:
• SQL injection
• Path traversal
• Remote code execution
• Server side request forgery
• Cross site scripting
This type of validation can potentially reduce the amount of time security engineers spend manually confirming routine findings.
AI Can Discover Complex Vulnerability Chains
The most interesting findings were not necessarily isolated coding mistakes.
The report describes multiple cases where weaknesses could be combined to create more significant attack paths.
One example involved a cache poisoning weakness affecting a JavaScript serving infrastructure. An input value could influence returned content without being appropriately represented in the cache key, potentially allowing a malicious response to be stored and delivered to other users.
Google reported that it found no evidence that attackers exploited this issue.
However, the research demonstrated how seemingly separate web application behaviors can combine into a larger security risk.
Another example involved an administrative workflow where an authorization mechanism initially prevented direct exploitation. PageBreak identified another endpoint that could generate the required signature, allowing the security controls to be chained into an XSS path.
A third scenario involved an extension environment where weaknesses involving external connections, nonce handling, message forwarding, and data URLs could combine to create arbitrary JavaScript execution.
These examples demonstrate an important lesson:
A vulnerability that appears low risk in isolation can become much more serious when combined with another weakness.
The Importance of Exploit Chains
Modern applications rarely consist of a single component.
They may include:
• Web applications
• APIs
• Authentication systems
• Browser extensions
• Cloud services
• CDNs
• Administrative interfaces
• Third party integrations
• JavaScript libraries
• Internal development platforms
Attackers can look for relationships between these components.
A security assessment that examines vulnerabilities independently may therefore miss the bigger picture.
AI assisted security testing could help identify relationships between weaknesses and determine whether multiple issues can be combined into a realistic attack path.
Secure Frameworks Still Matter
The research also provides an important lesson about secure application architecture.
According to the report, PageBreak found only two XSS issues among hundreds of applications built using Google’s high assurance web frameworks. The identified issues were associated with internal applications or debugging endpoints where additional hardening was required.
This suggests that secure development frameworks and standardized security controls can prevent entire classes of vulnerabilities.
AI based security testing should therefore not replace secure software development.
It should complement it.
Organizations should combine:
• Secure coding practices
• Security focused frameworks
• Automated testing
• AI assisted vulnerability discovery
• Human security review
• Penetration testing
• Threat modeling
• Continuous monitoring
AI Security Tools Still Need Human Oversight
Automation can dramatically improve security testing, but it is not infallible.
The report acknowledges that incomplete validators can potentially miss genuine vulnerabilities.
This is an important consideration for organizations adopting AI security tools.
AI generated findings should be treated as security intelligence that requires appropriate validation, not automatically accepted as fact.
Similarly, automated remediation should be reviewed before changes reach production environments.
The strongest approach is a combination of:
AI discovery + automated validation + human security expertise.
What Organizations Should Do Now
Organizations looking to adopt AI assisted application security should consider several practical steps.
1. Add AI Assisted Vulnerability Discovery
AI can help security teams analyze large codebases, identify suspicious patterns, and prioritize areas requiring deeper investigation.
2. Focus on Verification
Potential vulnerabilities should be validated in controlled environments before they are classified as confirmed findings.
3. Test Attack Chains
Security assessments should examine whether multiple low or medium risk weaknesses can be combined into a higher impact attack.
4. Strengthen Secure Development Frameworks
Organizations should use secure frameworks and standardized development controls to prevent recurring classes of vulnerabilities.
5. Integrate AI With Existing Security Programs
AI security testing should complement SAST, DAST, SCA, API security testing, penetration testing, and manual code review.
6. Maintain Human Review
Security engineers should validate important findings and proposed remediation before production deployment.
7. Continuously Test Internet Facing Applications
Public facing applications should be assessed regularly because vulnerabilities can emerge as applications, dependencies, APIs, and configurations change.
Industries That Can Benefit
Financial Services and Banking
Banks, fintech companies, payment providers, and investment firms operate highly targeted web applications and APIs. AI assisted vulnerability discovery can help identify weaknesses in customer portals, authentication systems, APIs, and financial applications.
Healthcare and Life Sciences
Healthcare organizations manage sensitive patient information through web applications, portals, APIs, and cloud platforms. Continuous application security testing can help identify vulnerabilities before they expose regulated information.
Retail and E-commerce
Retailers depend heavily on web applications, payment platforms, customer portals, APIs, and third party services. Automated vulnerability validation can help identify security weaknesses across rapidly changing digital environments.
Manufacturing and Industrial Organizations
Manufacturers increasingly rely on web applications, cloud platforms, supplier portals, and connected systems. Application security testing can help protect business operations and sensitive intellectual property.
Government and Public Sector
Government agencies operate public facing applications and digital services that can become attractive targets. Continuous security testing can help identify vulnerabilities before they are exploited.
Technology and SaaS Companies
Technology organizations are likely to benefit significantly from AI assisted security testing because their environments often contain large application portfolios, APIs, cloud infrastructure, and continuous development pipelines.
The Future of AI Driven Application Security
Google’s PageBreak project points toward a broader transformation in cybersecurity.
AI security tools are moving beyond simple vulnerability identification toward a workflow that can:
Discover → Validate → Reproduce → Prioritize → Remediate
This could significantly improve the ability of security teams to handle the scale and complexity of modern applications.
However, organizations should avoid treating AI as a replacement for experienced security professionals.
AI can accelerate analysis and testing, while human expertise remains essential for understanding business context, assessing real world impact, validating remediation, and making risk based decisions.
Conclusion
Google’s PageBreak research demonstrates how artificial intelligence can be used to scale application security testing and uncover complex vulnerability chains.
The discovery and validation of more than 500 XSS vulnerabilities shows the potential of AI to reduce the gap between vulnerability discovery and confirmed security findings. The reported exploit chains also demonstrate why organizations need to evaluate vulnerabilities in context rather than examining every security issue in isolation.
The future of application security will likely involve closer collaboration between AI powered security systems and human security professionals.
Organizations that combine automated vulnerability discovery, exploit validation, secure development practices, penetration testing, continuous monitoring, and expert review will be better positioned to identify weaknesses before attackers can turn them into real incidents.
About COE Security
COE Security partners with organizations in financial services, healthcare, retail, manufacturing, and government to secure AI-powered systems and ensure compliance.
Our offerings include:
• AI-enhanced threat detection and real-time monitoring
• Data governance aligned with GDPR, HIPAA, and PCI DSS
• Secure model validation to guard against adversarial attacks
• Customized training to embed AI security best practices
• Penetration Testing (Mobile, Web, AI, Product, IoT, Network & Cloud)
• Secure Software Development Consulting (SSDLC)
• Customized CyberSecurity Services
COE Security also helps organizations strengthen application security through AI assisted vulnerability assessments, web and API security testing, penetration testing, secure code reviews, threat modeling, vulnerability management, and continuous security monitoring.
For financial services and banking, COE Security helps assess customer facing applications, APIs, authentication systems, payment platforms, and sensitive financial environments.
For healthcare and life sciences, we help protect patient portals, healthcare applications, APIs, cloud environments, and sensitive information while supporting regulatory requirements.
For retail and e-commerce, we help secure web applications, payment environments, APIs, customer platforms, cloud infrastructure, and third party integrations.
For manufacturing and industrial organizations, we help assess enterprise applications, connected systems, cloud platforms, APIs, and digital infrastructure while strengthening secure development practices.
For government and public sector organizations, we help assess public facing applications, APIs, cloud environments, identity systems, and critical digital services through security testing and vulnerability management.
For technology and SaaS companies, we help strengthen application security through penetration testing, AI security assessments, API testing, secure development consulting, vulnerability management, cloud security assessments, and software supply chain security reviews.
COE Security also helps organizations evaluate emerging AI security risks and integrate AI assisted security testing into broader cybersecurity programs while maintaining appropriate human oversight and compliance controls.
Our goal is to help organizations identify security gaps earlier, reduce cyber risk, strengthen resilience, and maintain compliance across increasingly complex digital environments.
Follow COE Security on LinkedIn for ongoing insights into safe, compliant AI adoption and to stay updated and cyber safe.
Click to read our LinkedIn feature article