Google described PageBreak, an AI-agent system that finds XSS flaws in the company’s web applications. Official coverage said more than 500 issues were confirmed after technical validation: when the agent flags a suspect, a validator runs a concrete test to check exploitability. The design aims to cut false positives that waste security teams’ time. It fits a wider trend of using agents for security testing under human oversight.

What it means: The value is not only the count of findings but the verification chain before engineers open a ticket. Without a validator, agents fill queues with noise; with one, teams spend time on real XSS that can expose session data. Greek product companies should pair automated discovery with demonstrable exploitation in test environments rather than keyword scanning alone. There is also risk: tools that execute code against apps must be tightly isolated from production. EU expectations for secure development strengthen the case for measurable test coverage. Vendors selling AI pentest products should show confirmation rates, not only alert volume. DevSecOps teams can start with login and payment flows, where a single XSS has immediate business cost, and keep humans in charge of severity and remediation priority while agents handle repetitive reconnaissance across large application portfolios. This matters for planning, procurement and day-to-day governance in organisations that already use generative tools. This matters for planning, procurement and day-to-day governance in organisations that already use generative tools.

Read the original on Google / industry coverage of PageBreak

Related service: Custom software

Related stories