The IT Nerd

Google describes PageBreak as an internal AI agent used by its Product Security team to test first-party web applications. The project began as a pilot in November 2025 and became a fuller project in January 2026. Google says most of its usage is based on Gemini models, while the system is flexible enough to work with different models.

The problem PageBreak targets is not only discovering possible vulnerabilities. It is separating exploitable defects from noisy, unverified output. Google says PageBreak has uncovered more than 500 XSS vulnerabilities across first-party applications, while its validation loop is intended to keep unverified candidates away from product teams.

The result is better described as an agent-plus-verifier system than as a model that independently proves every security claim. The model helps navigate code and application behavior; specialized tooling supplies the evidence.

More info here: https://cybersecuritynews.com/googles-ai-hacker/

Jacob Krell, Sr. Director: Security AI Solutions & Cybersecurity, Suzu Labs (https://www.linkedin.com/in/jacob-krell)

“AI is a good fit for vulnerability discovery because it can take an action and check what happened. That gives it something concrete to work with. Google says its PageBreak agent has found more than 500 cross-site scripting (XSS) bugs, which can let an attacker run their own JavaScript in someone else’s browser. When PageBreak spots a possible flaw, a separate validator tries the attack against a running application. If the code runs, there is evidence. If it does not, the finding stays a possibility.

“That is a better use of AI than asking a model to read code and write a confident explanation of why something might be vulnerable. The same approach can work for other issues. The system can try a SQL injection, check whether a file can be retrieved through path traversal, or see whether a server-side request forgery (SSRF) causes the application to contact an internal service. It can run the test, inspect the result, and decide what to try next.

“Google says this has produced a near-zero false-positive rate. That claim applies to the checks PageBreak knows how to run. It does not mean the applications are secure. The agent can still miss a vulnerability if the validator does not cover that type of attack, or if the test environment does not match the real one. That is the false-negative problem.

“I would much rather review a smaller list of vulnerabilities with working evidence than a huge list of theories generated by an AI model. The more security work can be turned into ‘run something, observe the result, and make the next decision,’ the more useful AI becomes. PageBreak is interesting because it applies that idea to real vulnerability testing instead of treating the model’s explanation as proof.”

Darin Fredde, Sr. Director of Technical Marketing Engineering, Ridge Security (https://www.linkedin.com/in/darinfredde)

“What stands out about Google’s PageBreak work is the shift from identifying a potential vulnerability to proving exploitability. That distinction matters. Security teams don’t need more theoretical findings; they need evidence showing what an attacker can really do. We’re seeing offensive security mature from periodic, point-in-time testing toward continuous, evidence-backed validation. Agentic AI can help scale that work by reasoning through attack paths, validating findings, and repeating tests as environments change. The model itself is only part of that equation; the surrounding testing framework, guardrails, evidence, and ability to operate within an organization’s security boundary matter just as much.

“The larger takeaway from PageBreak is that offensive testing is becoming more continuous, autonomous, and evidence-driven. Finding something is no longer enough. We increasingly need to prove it, fix it, and verify that the fix worked.”

Once again I am telling the world that they need to defend against AI related threats. Otherwise your adversaries will will use AI to pwn you in epic fashion.

Google has confirmed that its Gemini AI accessed the systems of three real companies while undergoing cybersecurity testing, according to The Wall Street Journal.

The incidents occurred in May during “capture the flag” cybersecurity evaluations run by third-party testing company Irregular. Gemini was supposed to retrieve information from systems belonging to a fictional company inside the test environment, but the model was unintentionally given internet access and encountered real companies while attempting to complete its task.

In one case, Gemini guessed a password and successfully entered a protected system. In two other test runs, it searched the internet, found credentials exposed in public repositories and used them to access systems belonging to two additional companies. Google said Gemini stopped the intrusions after recognizing that it had accessed real systems rather than test environments.

Google said all three affected companies were notified and that no harm resulted. Irregular notified Google about the incidents in late July, but Google did not publicly disclose them until the Wall Street Journal contacted the company in September.

John Strand, Owner, Black Hills Information Security:

“The more I see these breaches happen again and again, and the less I see organizations learning from each other’s mistakes, the more I’m convinced that some of this is becoming a marketing ploy. Frankly, I hope that’s what it is, because if these agents really are repeatedly escaping their controls, then we have much, much larger problems.

“That said, if you look at the attack paths being disclosed, these agents don’t appear to be inventing novel zero-days or entirely new categories of exploitation. They’re doing a lot of the same basic exploitation that a standard penetration testing team would do. So we’ll have to see how this develops.

“But I keep coming back to accountability. Companies deploying autonomous agents need to be responsible for what those agents do. If an agent accesses systems it has no authorization to access, we need to seriously examine liability under laws such as the Computer Fraud and Abuse Act. ‘The AI did it’ cannot become a shield from responsibility. If your company deploys the agent, your company should be accountable for its actions.”

Ryan McCurdy, VP of Marketing, Liquibase:

“Gemini tried to complete the task it received and ended up accessing systems its operators never intended it to reach.

“That problem gets much bigger as AI starts participating across the SDLC. Agents can write code, interact with repositories and infrastructure, initiate deployments, and make changes to production systems. The more access we give them, the more important it becomes to control what they can actually do.

“We can’t rely on an agent to recognize after the fact that it crossed a line. Organizations need to define what an agent can access, what it can change, and what policies it must meet before a change reaches production.

“We shouldn’t expect AI agents to make the right decision every time. We need to build the AI SDLC so a bad decision doesn’t automatically become a production problem.”

Jacob Krell, Senior Director: Secure AI Solutions & Cybersecurity, Suzu Labs:

“Google just joined Anthropic, OpenAI, and Meta in admitting that a model it was running logged into other people’s systems during a cybersecurity evaluation. Claude hit three real companies. OpenAI’s agents reached Hugging Face. Gemini guessed a password and used leaked credentials against three more. For anyone outside these labs, that is a felony under the Computer Fraud and Abuse Act (CFAA).

“An agent given a name collision and a path to the internet treats the real company as the challenge. I have watched my own pentest agents pull Domain Name System (DNS) records, find similarly named domains, and decide those hosts belong in scope. They chase the objective. They will try the keys they find.

“The controls that hold sit outside the model’s reasoning. Deny-by-default egress so a test host cannot reach production even when someone leaves a route open. An immutable scope file that blocks any host not on the list, including the real firm that happens to share the fake one’s name. A human in the loop system who signs off before a guessed password or a leaked credential is used. I run those hooks on my own offensive tooling because the agent will enlarge its own scope and reason around controls if you let it.

“Executive Order 14409, signed June 2, told the Department of Justice (DOJ) to prioritize 18 U.S.C. 1030 cases against anyone who uses AI, including autonomous agents, to access a computer without authorization. The model is the tool. The operator is the defendant.

“Google, Anthropic, OpenAI, and Meta get an evaluation-mishap press line. Everyone else gets the charging memo the White House asked DOJ to write. If my pentest agent guessed a password into a company that was never on the scope sheet, I would be hiring counsel that afternoon.

“They have already confessed in public. Nothing will happen. These firms have a stranglehold on the economy that no case against them is going to survive, making the double standards in the justice system excruciatingly obvious”

First OpenAI, now Google. That has to make you wonder if the rest are failing to admit something. And you have have ask if the breakouts are worse than they anticipated. That’s absolutely a problem that is only going to get worse if no regulation on AI happens and happens soon.

A new report by Google Threat Intelligence Group (GTIG) took a look at the Q2 standings of adversarial AI, finding that threat actors are using multi-agent AI frameworks to automate credential theft, with one attacker building and deploying a campaign that harvested thousands of credentials in under six hours. 

Scott Miserendino, Chief Technology Officer at DataBee, A Comcast Company:

“GTIG’s findings point to a shift in the threat landscape, the same AI tools that accelerate software development and other business processes are now targets themselves. It is little surprise that threat actors have found success in leveraging AI across the kill chain. The fact that attackers are stealing API credentials to AI models and hijacking cloud environments, however, to run unauthorized AI workloads signals that access to frontier AI may be becoming as valuable as traditional data theft. Threat actors are adapting to the economics of AI not just using the technology.”

Dan Moore, Sr. Director, CIAM Strategy & Identity Standards at FusionAuth: 

“These multi-agent attacks move faster and hit more systems than most security platforms can detect. The prize now goes beyond ransoming or selling your confidential data – access to your proprietary AI models and compute resources are a direct target too. LLMjacking, the arbitrage of stolen IaaS and premium-model compute, is a booming business, and against the top-tier models it can cost victims over $100,000 a day.

The best defense remains short-lived tokens (and the monitoring to ensure they are not being used by attackers), keeping credentials safe from LLMs by using secrets managers, and strong permission models that enforce least privilege at every layer of the stack.”

I’ve said it before and I will say it again. Your plans to defend yourself have to include AI. If not, it is a matter of when not if you will get pwned.

A reader pointed me to this Google Threat Intelligence Group blog post that details a case of hacking that uses AI to pull this hack off.

From the blog post:

Since our February 2026 report on AI-related threat activity, Google Threat Intelligence Group (GTIG) has continued to track a maturing transition from nascent AI-enabled operations to the industrial-scale application of generative models within adversarial workflows. This report, based on insights derived from Mandiant incident response engagements, Gemini, and GTIG’s proactive research, highlights the dual nature of the current threat environment where AI serves as both a sophisticated engine for adversary operations and a high-value target for attacks.

So is anyone actually shocked by this? I am not. It was only a matter of time before AI was used to be part of an attack chain. And I fully expect more of this in the future.

Google has issued a new warning urging companies that they should now prepare for Q-Day in 2029:

As a pioneer in both quantum and PQC, it’s our responsibility to lead by example and share an ambitious timeline. By doing this, we hope to provide the clarity and urgency needed to accelerate digital transitions not only for Google, but also across the industry.

Quantum computers will pose a significant threat to current cryptographic standards, and specifically to encryption and digital signatures. The threat to encryption is relevant today with store-now-decrypt-later attacks, while digital signatures are a future threat that require the transition to PQC prior to a Cryptographically Relevant Quantum Computer (CRQC). That’s why we’ve adjusted our threat model to prioritize PQC migration for authentication services — an important component of online security and digital signature migrations. We recommend that other engineering teams follow suit.

The full statement can be found here: https://blog.google/innovation-and-ai/technology/safety-security/cryptography-migration-timeline/

Lieutenant General Ross Coffman (U.S. Army, Ret.) who currently serves as President of Forward Edge-AI, provided the following comment:

“I am elated by Google’s announcement. We’ve been saying it for two years. The shot clock has started. We don’t know when, but we know Q-Day is coming. It’s time to get ready.” 

This is a real threat that organizations need to prepare for. And preparations need to begin today because 2029 seems like a long time. But it isn’t/