Google described PageBreak on September 24, explaining how its internal security agent investigates candidate vulnerabilities and uses validators to check whether an attack actually works.
The Google security post says the project entered a pilot in November 2025 and production use in January 2026. This is a report on an existing internal system, not the launch of a public security product.
The check happens outside the model’s explanation
Google’s account emphasizes deterministic validators operating against running environments. The intention is to distinguish a plausible description from a demonstrated issue before sending a finding to a product team.
The company reports finding more than 500 cross-site scripting issues across its first-party environment. That figure is Google’s reported result, not an independent benchmark.
The post also discusses the limits of validation coverage. A system can miss classes of issues its validators do not recognize. Rejecting an unverified candidate does not prove that the underlying code is safe.
Evidence matters more than a confident report
The approach highlights a broader requirement for action-taking AI: compare the claim with an observable result. For security work, a generated explanation alone is weak evidence of exploitability.
It also complicates comparisons between tools. A high count of candidate findings and a smaller count of verified findings measure different stages. Without scope and validation criteria, raw totals are difficult to interpret.
Our AI evaluation guide describes the same distinction between a run’s narrative and its final outcome. Google’s disclosure is useful as an engineering account, but it does not establish how another organization would perform with a similar system.
