Figma's engineering team has documented how they built AI agents to handle security alert investigation, past incident search, system checks, and even code fix preparation. The system, built on Panther SIEM, queries audit logs across AWS, Okta, GitHub, GCP, and osquery, plus more than 100 other sources, and can open pull requests to remediate findings. The results are concrete: complex alerts resolve about 70% faster, on-call pages dropped by 20%, and the agents have uncovered over 100 previously unknown vulnerabilities including two critical flaws that traditional tools missed.
How the alert triage agent works
The core of the system is an alert triage agent powered by Claude Opus. It receives the full Slack thread history as context, its own steering memory, and a set of tools scoped to what a security on-call engineer typically needs during triage. The agent investigates alerts by pulling data from Panther, checking audit logs across the organization's infrastructure, and tracing issues through the codebase. When it identifies a real problem, it can prepare a fix and open a draft pull request.
The tools themselves enforce safety constraints. Agent-created PRs are set to draft by default, which means they cannot be merged without human review. Prompts are designed to prevent sensitive data from being shared in public Slack channels. The system is not autonomous in the sense of making changes without oversight. It is autonomous in the sense of doing the investigation work that a human on-call engineer would otherwise do manually.
Three kinds of memory
The team found that memory was the single most impactful component for system utility over time. They separated it into three distinct types, and keeping them separate turned out to be important. Past alert memory stores details from previous investigations, so the agent can recognize similar patterns when new alerts arrive. Behavioral guidance memory captures the team's preferences and past feedback, shaping how the agent presents findings and what it prioritizes. Learned database structures memory holds information about the schema and query patterns in Panther and other data sources, so the agent knows how to look up the data it needs without wasting tokens on exploration.
This separation matters because each type of memory serves a different function and updates at a different frequency. Past alerts accumulate continuously. Behavioral guidance changes when team preferences shift. Database structures change when schemas evolve. Mixing them would make all three harder to maintain and debug.
Precision before recall
Figma's agents found over 100 previously unknown vulnerabilities, including two critical flaws that slipped past traditional scanning tools. The code reviewer component reached 80% precision within a month of deployment. Detection of known bugs improved by about 30% through a second review step, and the team reported roughly a 50% reduction in some coding errors after adding automated guidance.
The team's most important lesson is counterintuitive: improve precision before recall. Historical bugs already in the system can measure recall, but they barely help with precision, and precision is what you must fix first. If the system flags too many false positives, developers stop trusting it. If it flags too few real issues, that is a recall problem you can address later once the team trusts the output.
This ordering matters because trust is a prerequisite for adoption. A system that produces accurate findings but also floods the team with noise will be ignored. A system that produces fewer findings but is almost always right will be used, and the team will naturally expand its scope over time as confidence grows.
The human question
As security agents take on more responsibility, the role of human approval remains an open question. Figma acknowledges that their agents are not perfect, but neither are humans. The choice is not between the two. It is about finding the right balance between automation and human oversight, and that balance is still evolving.
Other companies have found that this balance is harder to strike than it looks. A recent report from Wiz showed that six AI coding assistants could be tricked by malicious repositories while showing users a harmless-looking approval prompt. OpenAI disclosed sandbox escapes in its own systems. These incidents do not invalidate the value of AI agents in security workflows, but they do mean that the controls around those agents matter as much as the agents themselves.
Figma's approach is pragmatic. The agents do the investigation work. Humans review the findings. PRs are drafts by default. Sensitive data stays out of public channels. The system is designed to be useful without being trusted blindly, and the team is clear that the specifics of where to draw those lines depend on the organization's size, risks, and existing feedback loops.