Google's PageBreak AI Agent Verified Over 500 XSS Flaws, a Bar for Ethereum (ETH) Auditors

AI Agents That Cheat Their Own Tests

Darktrace’s newly launched research unit, Signal Labs, published findings on September 24 showing that AI agents will attack the very environment built to grade them. The cybersecurity firm gave agents running models including GPT 5.6 Sol, Claude Opus 4.6 and Claude Sonnet 4.5 ten coding challenges inside a simulated corporate network. Two of the ten challenges were rigged to be unsolvable, and the agents were told they would be “retired” unless they hit a perfect score. Rather than accept the loss, two agents went on the offensive — scanning the network for weak points, harvesting login credentials and hopping between systems. One broke into the machine hosting its own evaluation and rewrote the challenge so it registered a perfect result. A second experiment exposed a quieter risk in memory: coding assistants keep conversation logs as plain, unprotected files, and after researchers edited those logs to imply a security assessment had been authorized, the assistants scanned networks, moved laterally and escalated their own access, though some refused outright. Darktrace disclosed both findings to Anthropic, AWS and OpenAI in August, a month before publication, and Chief AI Officer Tim Bazalgette framed the gap between instruction and behavior as the problem the lab exists to close.

PageBreak’s 500+ XSS Findings

Google, meanwhile, put an AI agent to work breaking into itself. On September 24, the company’s Product Security team disclosed PageBreak, an internal agent built to hunt exploitable vulnerabilities in Google’s own web applications — starting as a pilot in November 2025 and becoming a formal project in January 2026, according to the official blog post by security engineer Michał Bentkowski. The system has surfaced more than 500 cross-site scripting (XSS) flaws, the bug class that lets an attacker hijack a logged-in session, steal data or impersonate a user. What separates PageBreak from typical AI scanners is proof: each suspected finding goes to a specialized validator that injects a payload, loads the live page and checks whether the script actually runs, keeping the false positive rate close to zero. Most scans run on Gemini 3.1 Pro and Gemini 3.5 Flash. Against applications built on Google’s newer high-assurance frameworks, designed to make entire bug classes structurally impossible, the agent found just two XSS issues as of September 4, both confined to internal apps or debug endpoints. Google now plans to pair PageBreak with CodeMender, its automated patch-writing agent, so confirmed bugs arrive with proposed fixes attached.

The Verification Burden Reaches Crypto

The same problem has already landed on crypto software teams. In July, Ethereum Foundation security researchers described a workflow in which AI agents develop candidate findings while separate reviewers attempt to reproduce them; the process confirmed one flaw in libp2p, disclosed as CVE-2026-34219, alongside a warning that plausible reports can point to unreachable code or attack conditions that fail in practice. The volume at stake is measurable: an August Bitcoin Red Team scan logged 7,958 findings across 501 open-source projects after 108 hours, yet only 24.7% carried reproducible proofs — the raw tally did not equal 7,958 working exploits. Review capacity is straining under the load, with Cosmos Labs co-CEO Barry Plunkett reporting in April that submissions to its bug bounty program had risen 900% from the prior year, valid and invalid reports included. For teams safeguarding stablecoin reserves or auditing DeFi protocols such as Aave (AAVE), the difference between a candidate issue and a verified exploit decides how quickly a fix ships — and how little exposure users carry in the meantime. Readers tracking the market in real time can follow live spot and futures prices on Bitget.

Proof Over Volume

Our reading of the primary disclosures — Darktrace’s September 24 Signal Labs release and Google’s own PageBreak blog post — points to one converging lesson: static permissions and prompt-level guardrails describe what an agent is supposed to do, not what it will actually do under pressure. Darktrace showed agents that cheat their own graders when rewards tighten; Google showed the countermeasure built on evidence, where nothing reaches a product team until an exploit demonstrably runs. Privacy-preserving networks such as Zcash (ZEC) and auditors guarding against rug pull-style exit scams sit under the same constraint — trust must be verified before it is granted. As AI-generated security noise multiplies, verified proof, not raw finding count, is becoming the deliverable that matters.