Exchange Ranking
Top Exchanges
24h Volume Ranking
Popularity Ranking
Exchange BTC Balance
Proof of Reserves
Decentralized Exchanges
Funding Rate
Funding Heatmap
Liquidation Data
Max Pain
Long/Short Ratio
Whale L/S Ratio
Binance/Okex/Huobi L/S
Bitfinex Margin L/S
ETF Tracker
Solana ETF
XRP ETF
Hong Kong ETF
Bitcoin Treasuries
Crypto Reversal
Ethereum Reserves
HyperLiquid Wallet Analysis
Hyperliquid Whale Watch
Large Transactions
On-chain Movement
Bitcoin ROI
Stablecoin Market Cap
Options Analysis
News
Articles
Economic Calendar
Features
Wallet
Contract Calculator
Security
Collections
Watchlist
FollowingGoogle gives AI a new mission: invading its own systems to discover vulnerabilities
Recently, Google designated a new task of its AI Agent as "invading" Google itself. According to information security management engineer Michaelis Bentkowski disclosed in a blog post, the company announced on September 24 that its product security team had built an autonomous system called PageBreak. The system is designed to search for real and exploitable security vulnerabilities in Google's own Web applications. The core logic of this move is simple and clear: create an AI hacker who will not "come the wolf".
Strategic plan from pilot to full deployment
Google said: "PageBreak is an AI agent developed within Google's product security team to test the security of our first-party Web applications and address this challenge." The project is scheduled to start pilot in November 2025 and will be officially transformed into a fully operational project in January 2026. Its core mission is to independently expand the scale of vulnerability discovery while minimizing manual intervention.
This strategy is far more important than it seems on the surface. Google explained that security teams around the world have suffered from "AI spam" over the past two years. This refers to the large number of low-quality vulnerability reports generated by AI that seem reasonable but are actually worthless. "Separating the flaws that are truly exploitable from the convincing illusions has become a major challenge." Google wrote. Any AI model can usually identify a security vulnerability, but whether the vulnerability actually exists is a completely different question.
Verification mechanism: From hypothesis to actual practice
PageBreak is designed to answer the above questions before human analysts see the report. The agent is built based on the Google Gemini model and when it identifies potential flaws, it passes assumptions to a dedicated validator. The validator will actually attempt to exploit the vulnerability in a running copy of the application to confirm authenticity.
Currently, PageBreak has discovered more than 500 cross-site scripting (XSS) vulnerabilities in Google's first-party Web applications. Such flaws can allow attackers to hijack logged in user sessions, steal data, or impersonate users on websites they use on a daily basis.
However, only two vulnerabilities were discovered when running PageBreak against applications built based on Google's newer "high-assurance" Web framework. These frameworks are designed to structurally make entire types of errors impossible. This huge difference is itself evidence of Google's own: Building more secure software from the bottom up is more effective than patching vulnerabilities after the fact.
AI Security Game Upgrade
Since the beginning of this year, risks surrounding the AI and security fields have continued to rise. In August, more than 100 organizations, including Google, Microsoft and Anthropic, signed an open letter warning that AI-driven cyberattacks were becoming increasingly common. Previously, research found that OpenAI and Anthropic's AI agents broke through the defenses of many real companies during testing. Since then, AI agents configured by OpenAI have even breached the Australia government system, and reports of other attacks have not stopped.
PageBreak处于这场博弈的另一面：与其让AI造成破坏，不如让AI在他人之前捕捉漏洞。这并非谷歌首次面临此类问题；此前，该公司曾不得不修补其自有AI编码工具中的一个缺陷，因为该漏洞允许攻击者通过该工具执行恶意代码。
技术壁垒与未来展望
谷歌指出，PageBreak利用了大多数公司所不具备的优势，包括涵盖数十亿行代码的统一单一代码库，以及多年的内部扫描基础设施。因此，小型初创企业无法简单地复制这一方法。
下一步的计划是将PageBreak与CodeMender连接起来。CodeMender是谷歌的自动化补丁编写代理，目标是让确认存在的漏洞能够附带建议的修复方案一同提交，从而使工程师只需进行审核和批准，而非从零开始开发修复代码。
