How Figma Uses AI Agents to Speed Up Security Incident Response

O time de engenharia do Figma publicou dois textos detalhando como construiu agentes de IA para apoiar o time de segurança: investigar alertas, buscar em incidentes passados, checar sistemas da empresa e até preparar correções de código.

Figma's engineering team published two articles detailing how it built AI agents to support the security team: investigating alerts, searching past incidents, checking company systems, and even preparing code fixes. According to the documentation reported by InfoQ, the agents learn from previous investigations and help resolve complex alerts about 70% faster, with human review and strict controls kept in the workflow.

The point that matters for those who design products and run Figma in production isn't the number, it's the design of the decision: instead of outsourcing judgment to the model, Figma modeled where the human stays in command and where the agent can act on its own. This split of responsibility is a product choice, not an infrastructure one.

How the System Is Built

The foundation is a SIEM (Panther) that investigates alerts and cross-references audit logs across AWS, Okta, GitHub, GCP, and osquery, the open source tool that lets you query machines with SQL for security and system data. According to the report, the system queries more than 100 other sources and can open pull requests.

The heart of the investigation is the alert triage agent, running a model on the scale of Claude Opus. In the words of the authors, Matthew Sullivan (formerly of Figma, now at Nition) and Brad Girardeau (Figma's security engineering manager):

The alert triage agent (using a model like Claude Opus) is where most of the investigation happens. It receives the full Slack thread history as context, its own guidance memory, and a set of tools scoped to what an on-call security engineer typically needs during triage.

>

-- Matthew Sullivan and Brad Girardeau

The agent receives the entire Slack thread as context, plus its guidance memory, and operates with tools scoped to what an on-call engineer actually uses. Under the hood, the agentic system uses AWS Bedrock Knowledge Bases, Amazon Kendra, Tines, and a Snowflake-based tool to search historical alerts and investigate Panther data.

Memory Is What Makes the System Improve

The most transferable detail for anyone building AI products is here. The authors say memory was the factor with the greatest impact on the system's usefulness over time, and that keeping memory types separate was decisive:

Memory ended up being the thing that had the biggest impact on how useful the system became over time. We have several types, and keeping them separate turned out to be important.

>

-- Matthew Sullivan and Brad Girardeau

There are three types that help the agent improve its investigations:

• Past alerts, to recognize patterns already seen;
• Behavioral guidance, what the team has learned about how to conduct triage;
• Learned database structures, so as not to rediscover data schemas with every investigation.

For those designing AI products, the lesson is that "memory" isn't a single bucket: segmenting what the agent remembers by purpose changes the quality of the response. It's an experience architecture decision, not just a prompt one.

Where the Brakes Are

The security controls were built into the tools themselves, not left to the model's good judgment. Two concrete examples cited:

• PRs created by the agent go in as drafts by default, requiring review before any merge;
• Prompts are designed to prevent sensitive data from leaking into public Slack channels.

This is the kind of guardrail that separates a demo from a production system. The agent can act, but its dangerous range of action is locked down by design.

The Other Report: Vulnerability Hunting

In a separate piece, "How Figma stays ahead of vulnerabilities with agents," the team reported that the agents found more than 100 unknown vulnerabilities, including two critical flaws that traditional tools had missed. The code reviewer reached 80% precision within a month, detection of known bugs improved by about 30% with a second review step, and there was a roughly 50% drop in certain coding errors after adding automated guidance.

The authors' practical recommendation is counterintuitive and applies to any team building AI evaluation:

We can't say exactly what to do: the details depend on your company's size, the risks you face, and the feedback cycles you already run. But one key lesson is to improve precision before recall.

>

-- Figma engineering team

The argument: the historical bugs you already have only measure recall, they barely help with precision, which is the problem that needs to be solved first.

What Remains Open

As teams give agents more responsibility, the role of human approval remains an open question, something Figma itself acknowledges. The risk context isn't theoretical: Wiz reported in "GhostApproval: A Trust Boundary Gap in AI Coding Assistants" that six AI coding assistants could be tricked by malicious repositories while showing the user a harmless-looking approval prompt. InfoQ also recently covered OpenAI's disclosure about sandbox escapes.

Figma admits its agents aren't perfect, but argues that humans aren't either, and that the choice isn't between one or the other, the balance between automation and human oversight is still evolving.

What This Changes for Those Running Figma in Brazil

For product and design teams that use Figma in production, two practical points. First, it's the tool's own maker exposing how it runs security with agents, which gives a concrete reference map for anyone who wants to build something similar internally, without relying on generic vendor material. Second, the design is replicable at a smaller scale: separating memory types, locking controls into the tools instead of trusting the model, and keeping PRs as drafts are decisions that fit a small security or platform team, not just a company the size of Figma. The 70% figure depends on each operation's context, but the skeleton of the decision, what the agent can do on its own and where the human remains mandatory, is what's worth taking home.