Google says its Gemini-based PageBreak agent has found more than 500 XSS vulnerabilities in its web applications since full operation began in January. Findings reach product teams only after a deterministic validator, written by security engineers and kept outside the agent loop, reproduces the exploit against a running app. Google claims a near-zero false positive rate, though InfoQ notes the figures are not independently validated and some real bugs may be missed. The useful pattern for teams is gating agent output behind code-based verification.
