How Figma Uses AI Agents for Security

Renato Losio · rss · 2026-09-06 source ↗ Reader 🖥️

practical · mixed — An InfoQ news brief reporting on two Figma engineering-blog posts (alert triage/investigation agents, and vulnerability/code-review agents). It is mostly expository (relaying Figma's own claims and quotes) but functions narratively as a case study, and closes with an argumentative frame (agents-vs-humans is a false binary; the right balance is still evolving) plus adjacent context (Wiz's GhostApproval report, OpenAI's sandbox-escape disclosure) that implicitly argues security teams should adopt agentic tooling cautiously rather than either rejecting or fully trusting it.

Structure

Key terms

• steering memory
  One of the alert-triage agent's context inputs alongside Slack thread history and scoped tools -- described as a distinct memory type that shapes agent behavior, separate from the memory of past alerts and from learned database structures.
• precision before recall Precision/Recall Tuning & Reporting
  Sullivan and Girardeau's tuning-order principle: fix an agent's false-positive rate (precision) before trying to improve its false-negative rate / coverage (recall), because a team's inventory of already-known historical bugs can only be used to measure recall, not precision.
• draft by default
  A specific, tool-level safety control: pull requests an agent opens are automatically created in GitHub's draft state rather than ready-for-review, so an agent's code fix cannot be merged, or even flagged for standard review, without a human first promoting it out of draft.

Propositions

• explicitFigma built AI agents to help its security team investigate alerts, search past incidents, check company systems, and prepare code fixes.conf: high
• explicitThe agents learn from previous investigations, reducing repetitive work and helping engineers resolve complex alerts about 70% faster, while human review and strict controls remain in place.conf: high
• explicitThe alert triage agent, using a model like Claude Opus, receives the full Slack thread history as context, its own steering memory, and a set of tools scoped to what a security on-call engineer typically needs during triage.conf: high
• explicitThe agentic system is built on Panther SIEM, checks audit logs and systems across AWS, Okta, GitHub, GCP, and osquery, queries more than 100 other sources, and integrates AWS Bedrock Knowledge Bases, Amazon Kendra, Tines, and a Snowflake-based tool to search historical alerts and investigate Panther data.conf: high
• explicitThree types of memory -- past alerts, behavioral guidance, and learned database structures -- kept separate, are what had the most impact on how useful the system became over time.conf: high
• explicitSafety controls are built into the tools themselves: agent-created PRs are set to draft by default, and prompts are designed to prevent sensitive data from being shared in public Slack channels.conf: high
  supportsYour AI agent just blamed the network team. Now what? · p11 — Figma's draft-PR-plus-human-review pattern is a concrete instance of the read-only/limited-autonomy middle phase in this piece's general shadow-mode -> read-only human-in-the-loop -> limited-automated-response trust progression for autonomous diagnostic/remediation agents.
• explicitThe system reduced on-call pages by about 20% by lowering the severity of some alerts, alongside the ~70% resolution-time reduction for complex alerts.conf: high
• explicitA companion Figma blog post reports that its agents found more than 100 previously unknown vulnerabilities, including two critical flaws missed by traditional tools, and that its code reviewer reached 80% precision within a month.conf: high
• explicitThe team reports about a 30% improvement in detecting known bugs through a second review step, and about a 50% reduction in some coding errors after adding automated guidance.conf: high
• explicitThe main stated lesson is to improve precision before recall, because the historical bugs a team already has can only measure recall and barely help with the precision that must be fixed first.conf: high
  refinesArticle: Agentic Fitness Functions: Extending Evolutionary Architecture Beyond Deterministic Rules · p3 — Refines the general 'calibrate for acceptable precision, recall, and variance before increasing influence' principle by specifying that order matters: optimize precision before recall, because a team's historical bug data can only ever measure recall.
• explicitFigma concludes its AI agents are not perfect but neither are humans, so the choice is not between the two, and the right balance between automation and human oversight is still evolving.conf: high
• implicitThe article reports Figma's percentage figures (roughly 70%, 20%, 80%, 30%, 50%) as established facts about the system's value, without flagging that all of them come from Figma's own engineers' blog posts, with no disclosed baseline, sample size, measurement window, or independent verification.conf: high
  supportsGitLab 19.2 Puts AI Agents to Work on the Security Backlog · p8 — Same pattern: Figma's 70%/20%/80%/30%/50% figures are self-reported by the company's own engineers with no disclosed methodology or baseline, corroborating GitLab's self-commissioned 400% ROI figure as another instance of unverified vendor claims specifically in AI-security tooling.
  supportsExpanding Daybreak as the Cyber Defense Window Narrows | OpenAI · p10 — Extends the same single-source, no-independent-verification evidentiary pattern (there, OpenAI's one 'trusted partner' quote; here, Figma's own blog posts) to another AI-security vendor claim.
• implicitBy placing Wiz's GhostApproval finding (six AI coding assistants could be tricked into showing users a spoofed, harmless-looking approval prompt) and OpenAI's sandbox-escape disclosure immediately after the Figma story, the author implicitly signals that 'human review remains in place' is not yet a fully trustworthy safety guarantee -- without ever connecting that implication back to Figma's own draft-PR-and-human-review safety design.conf: medium
  supportsAnthropic Details How It Contains Claude Across Web, Code, and Cowork · p1 — Figma's reliance on 'human review remains in place' as its safety backstop is exactly the kind of model-level/procedural control Anthropic's own finding says can influence but never guarantee agent behavior -- only environmental/architectural boundaries can; the article's own Wiz GhostApproval reference makes the identical point about approval prompts specifically.
• implicitFigma's finding that keeping the three memory types separate 'turned out to be important' implies that conflating memory sources previously degraded agent reliability or usefulness -- a design lesson the article states as settled fact without explaining the mechanism by which separation helps.conf: medium

Arguments

Narratives

• The alert triage agent's investigative workflow: receiving full Slack thread history, its own steering memory, and a toolset scoped to what an on-call security engineer typically needs, then querying Panther SIEM, osquery, and 100+ other sources.
  → Shows, rather than argues, that a well-scoped, memory-augmented agent can substitute for the repetitive 'first investigation' phase of a security on-call rotation -- the same structural pattern as the corpus's ai-incident-copilot case, applied to security telemetry instead of infra logs.
• The headline percentage figures (70% faster resolution, 20% fewer on-call pages, 80% code-review precision, 30% better bug detection, 50% fewer coding errors) presented without a stated baseline, sample size, or measurement window.
  → Functions rhetorically as proof-by-headline-number -- the story of dramatic improvement substitutes for the methodological detail a skeptical reader would need to actually evaluate the claim.
• The vulnerability-hunting agent finding 100+ unknown vulnerabilities, including two critical flaws that traditional tools missed.
  → Supports the proposition that agent-found issues can exceed the coverage of existing tooling, implicitly modeling the 'precision before recall' lesson (a precision figure is given; no recall figure is).

Questions addressed

• ✅ Can AI agents take meaningful ownership of security-operations investigative and remediation work without compromising safety?
  Resolved affirmatively per Figma's own account: scoped tools, separated memory, draft-by-default PRs, and anti-leak prompts are offered as the answer -- but this resolution rests entirely on Figma's self-reported figures.
• ⭕ What is the right balance between agent autonomy and human oversight in security workflows?
  Explicitly left open -- the article states the balance 'is still evolving' and frames this as an industry-wide open question, not something Figma claims to have solved.
• ⭕ Are the human-approval and review mechanisms that are supposed to make agent autonomy safe (draft PRs, approval prompts) themselves trustworthy?
  Not resolved, and not directly asked -- the article juxtaposes Figma's reassuring case study with Wiz's GhostApproval finding (approval prompts can be spoofed) but never connects the two or asks whether Figma's own PR-approval workflow could be vulnerable to the same class of trust-boundary gap.

Gaps

• incompleteNo disclosed baseline, methodology, sample size, or measurement window for the headline 'about 70% faster' and 'about 20% fewer on-call pages' figures -- both come solely from Figma's own blog post, via two Figma-affiliated authors (one of whom has since left the company).
  Read next: Look for independent, DORA-style verification of AI-security-agent ROI; cross-read against the corpus's other vendor-self-reported-metrics cases (GitLab's Forrester-commissioned 400% ROI figure, OpenAI's single-customer Daybreak testimonial) for the recurring pattern of unverified vendor claims presented as settled fact.
• incompleteNo recall or false-negative figures are given for the vulnerability-hunting or code-review agents -- only precision (80%) and detection-improvement percentages are reported, so a reader cannot tell how many real vulnerabilities or bugs the agents miss. This is exactly the blind spot the article's own 'precision before recall' framing would predict if recall improvement is being deliberately deferred.
  Read next: Read Figma's full engineering blog posts (linked from the article) for any recall/false-negative disclosure; compare against extract-multi-agent-ai-production-security-operations#g2, which raises the identical unmeasured false-negative gap for a telco SOC's anomaly-gating layer.
• illogicalThe article treats 'human review and strict controls remain in place' as sufficient reassurance about agent safety, without engaging its own adjacent report -- in the same piece -- that Wiz found six AI coding assistants could be tricked into showing users a spoofed, harmless-looking approval prompt (GhostApproval), which directly challenges whether human-approval interfaces are a reliable safety backstop for exactly the kind of agent-created-PR workflow Figma relies on.
  Read next: Read Wiz's 'GhostApproval: A Trust Boundary Gap in AI Coding Assistants' report in full, and check whether Figma's own PR-approval tooling was in scope for that vulnerability class.
• incompleteNo description of how the alert-triage agent's cost or inference volume is managed at scale -- e.g. whether every alert invokes the LLM agent directly, or whether a cheaper deterministic/heuristic pre-filter (comparable to the anomaly-detection gating layer in a telco SOC architecture elsewhere in the corpus) triages first.
  Read next: Read the full Figma blog post for volume/cost details; compare to extract-multi-agent-ai-production-security-operations#p5's Isolation-Forest pre-filter pattern for gating expensive LLM inference behind cheap anomaly detection.
• illogicalFigma's closing framing -- 'the choice is not between the two' (agents vs. humans) -- reframes a calibration question (how much autonomy, verified how, at what pace) as a false binary that nobody in the article was actually proposing, letting the piece end on a resolved-sounding note without actually answering the open question it just raised.
  Read next: Compare against extract-ai-agent-blame-network-team's explicit three-phase trust-and-autonomy progression (shadow mode -> read-only human-in-the-loop -> limited automated response), which answers the calibration question this article's closing line sidesteps.

Related documents

• Your AI agent just blamed the network team. Now what?
  Agent Security Guardrails Human-in-the-Loop SRE & Incident Response
• Article: Agentic Fitness Functions: Extending Evolutionary Architecture Beyond Deterministic Rules
  Agent Security Guardrails Human-in-the-Loop
• Building an AI Incident Copilot: How I Automated the First 15 Minutes of Every Production Incident
  Guardrails Human-in-the-Loop SRE & Incident Response
• Anthropic Details How It Contains Claude Across Web, Code, and Cowork
  Agent Security Guardrails Human-in-the-Loop
• Inside Claude Code Auto Mode: Anthropic's Autonomous Coding System with Human Approval Gates
  Agent Security Guardrails Human-in-the-Loop
• How GitHub Is Securing Agentic Workflows in Modern CI CD Systems
  Agent Security Guardrails Human-in-the-Loop
• Grab Cuts Mechanical Analytics Work From 44% to 30% with AI Agents
  Guardrails Human-in-the-Loop SRE & Incident Response
• Expanding Daybreak as the Cyber Defense Window Narrows | OpenAI
  AI-Driven Vulnerability Discovery Guardrails Vendor Self-Reported Metrics
• The Language of AI Could Change How Humans Speak
  Agent Security AI-Driven Vulnerability Discovery Guardrails
• Podcast: Securing AI Agents: Identity, Authorization, and the DPACT Framework
  Agent Security Guardrails Human-in-the-Loop