Google 披露 PageBreak AI 安全智能体，已发现 500 多个 XSS 漏洞

根据谷歌发表的一篇论文，其人工智能驱动的安全智能体自 1 月正式全面投入运行以来，已在谷歌的 Web 应用中发现了 500 多个 XSS 漏洞。Google PageBreak 使用 Gemini 模型自主调查潜在漏洞，但只有在确定性验证器成功在运行中的应用上重现漏洞利用后，才会提交报告，因此误报率几乎为零。According to a paper published by Google, its AI-powered security agent has uncovered more than 500 XSS vulnerabilities across its web applications since entering full operation in January. Google PageBreak uses Gemini models to autonomously investigate potential vulnerabilities, but reports them only after deterministic validators successfully reproduce the exploit against a running application, resulting in a near-zero false-positive rate.

借助 PageBreak，每个漏洞假设都会在运行环境中通过真实攻击手段进行测试，例如执行 JavaScript 来验证 XSS、向全局可读位置写入文件来验证路径遍历，或触发外部 DNS 请求来验证 RCE。Google 信息安全工程师 Michał Bentkowski 解释道：With PageBreak, every vulnerability hypothesis is tested against a running environment with a real exploit, such as executing JavaScript for XSS, writing to a world-readable location for path traversal, or triggering outbound DNS for RCE. Michał Bentkowski, information security engineer at Google, explains:

在 PageBreak 的早期开发阶段，我们有意识地决定优先采用确定性验证。系统不会仅根据代码模式推测漏洞，而是通过在运行环境中验证潜在缺陷来形成闭环。这种方法使误报率接近于零，确保我们不会用未经验证的漏洞报告给产品团队造成过多负担。

Early on in the development of PageBreak, we made a conscious decision to prioritize deterministic validation. Rather than simply hypothesizing bugs based on code patterns, the system closes the loop by verifying potential flaws against running environments. This approach results in a near-zero false positive rate, ensuring that we avoid overloading product teams with unverified vulnerability reports.

Google 还会在内部保留非确定性发现，作为未来深入扫描的线索，找出其验证能力中的缺口，并指导新验证器的开发。这些未经验证的候选结果不会发送给产品团队，从而让他们专注于高置信度漏洞。本特科夫斯基写道：Google also retains non-deterministic findings internally to seed deeper future scans, identify gaps in its validation capabilities, and guide the development of new validators. These unverified candidates are not sent to product teams, keeping their attention focused on high-confidence vulnerabilities. Bentkowski writes:

尽管确定性验证是我们的黄金标准，但我们也意识到，目前的验证器功能有限，无法覆盖所有漏洞类型或复杂场景。因此，可能会出现漏报，而非确定性验证器或许能够发现这些问题。

While deterministic validation is our gold standard, we are aware that our validators are currently lacking in capabilities to cover all vulnerability types or complex scenarios. This comes with the risk of false negatives that might have otherwise been caught by non-deterministic validators.

在 Google Bug Hunters 上的另一篇文章《Google 的 PageBreak 项目——真实世界的发现》中，Bentkowski 介绍了 PageBreak 发现的三个技术案例：一个 XSS 漏洞、一个由服务配置错误导致的缓存投毒问题，以及一个路径遍历漏洞。Google 高级员工信息安全工程师 Lukas Weichselbaum 在 LinkedIn 上强调了减少误报的重要性：In the separate article, "Google’s PageBreak Project – Real-World Findings," on Google Bug Hunters, Bentkowski describes three technical cases found by PageBreak: an XSS vulnerability, a cache-poisoning issue caused by a service misconfiguration, and a path-traversal vulnerability. On LinkedIn, Lukas Weichselbaum, senior staff information security engineer at Google, stresses the importance of reducing false positives:

许多由 AI 生成的 Bug 报告听起来很有说服力，但最终证明是错的，收到这些报告的团队不得不花时间逐一核查。在 PageBreak 中，模型可以随意提出建议，但只有经过验证器使用真实载荷确认后，某项发现才算数。验证器是由安全工程师编写的普通代码，而非模型生成的，并且运行在智能体循环之外。

A lot of AI-generated bug reports sound convincing but turn out to be wrong, and the teams that get them waste time checking each one. In PageBreak, the model can suggest whatever it likes, but a finding only counts once a validator confirms it with a real payload. The validators are plain code written by security engineers, not by the model and live outside the agent loop.

Bentkowski 表示，PageBreak 得益于 Google 的工程环境，尤其是 Google 单一代码仓库带来的端到端代码可见性、能够将实时 HTTP 流量与源代码关联起来的安全信号，以及可为其 Web 应用提供经身份验证访问的现有扫描基础设施。Bentkowski says PageBreak benefits from Google's engineering environment, particularly Google’s monorepo end-to-end code visibility, security signals that connect live HTTP traffic to source code, and existing scanning infrastructure that provides authenticated access to its web applications.

为了实现长期目标——将产品团队的参与减少到只需验证 AI 生成的修复方案——Google 正在将 PageBreak 与 CodeMender 等其他智能体安全项目集成，以自动生成针对其发现的漏洞的修复方案。With the longer-term goal of reducing product-team involvement to validating AI-generated fixes, Google is integrating PageBreak with other agentic security initiatives such as CodeMender to automatically generate fixes for the vulnerabilities it discovers.

尚未提供对这 500 多个漏洞的独立验证。No independent validation of the 500+ vulnerabilities has been provided.