A Google internal AI agent has discovered more than 500 cross-site scripting (XXS) flaws on the company's own Web applications, by using a combination of AI and validation to provide an overview of vulnerabilities that can likely be exploited and thus should be addressed.
PageBreak is an agent of Google's Product Security team that the company developed to test the security of its first-party Web applications and address any security challenges, the company quietly revealed in a blog post last month. The agent began in pilot form last November and moved to a full-fledged product in January, with a mission "to autonomously scale vulnerability discovery while minimizing manual toil," Google information security engineer Michał Bentkowski wrote in the post.
Among the flaws in Google Web apps identified by PageBreak are a cache poisoning in apis.google.com; an XSS flaw in admin.google.com; and insecure external handshakes in browser extensions. The company outlined the three flaws, which have been fixed, in a companion blog post.
Google did not immediately respond to a request for the status of fixes for all the flaws identified by PageBreak. However, Google eventually intends to connect PageBreak with CodeMender, its automated vulnerability-fixing system, so that once the former identifies a verified flaw, the latter can generate a proposed fix for product engineers to validate and apply.