According to CoinMeta, Google disclosed that its PageBreak AI security proxy identified over 500 cross-site scripting (XSS) vulnerabilities in the company's web applications. The project began as a pilot in November 2025 and was officially launched in January 2026 to test Google's web applications, during which XSS vulnerabilities were discovered on sensitive domains. Google did not specify which applications were affected. The XSS vulnerabilities allowed attackers' scripts to run in other users' browsers, potentially leading to data breaches or hijacking of user sessions. Google stated that the verification steps for PageBreak result in an almost zero false-positive rate, and this proxy can also test for other types of vulnerabilities. Google's report is based on scans of its own applications and it has access to Google's code and traffic data.