The company says agents cut complex-alert resolution time by roughly 70 percent. The more important story is how Figma separated memory, authority and control.
The most interesting thing about Figma’s new internal security agent is not that it can investigate alerts, query logs or write code. It is that Figma has designed the system so the underlying model does not have to be trusted. It’s not perfect or even mature or completely proven, but it manages a certain assumption: agents are going to be hard to control. And it systematically reduces the blast radius of an agent behaving incorrectly.
In a July 29 engineering post, the design software company released some stats from an agentic incident investigation system built over its Panther security platform. It investigates alerts across AWS, Google Cloud, Okta, GitHub, endpoint telemetry and roughly 100 other data sources. It can retrieve previous investigations, execute Snowflake queries, identify likely causes and open pull requests to remediate problems.
Figma says it has reduced resolution time for complex alerts by approximately 70 percent and cut on-call pages by 20 percent. More important is the architecture: different forms of memory, narrowly scoped tools, persistent state and controls enforced outside the model. This is much closer to deployable enterprise AI than a general-purpose agent simply being handed access to company systems.
From retrieval to investigation
Figma’s security team initially wanted a better way to find earlier alerts and the reasoning used to resolve them. When Panther raises an alert, Figma indexes information such as the user, IP address, account, severity and timestamp. Comments left by engineers in Slack or Asana become investigation context.
When a similar alert occurs, the system retrieves recent precedents and shows what happened before. A matching incident from two days earlier is deliberately weighted more heavily than an identical alert from six months ago because infrastructure and security practices change.
This retrieval layer helped identify benign or duplicate alerts. Those receiving a sufficiently high confidence score could be downgraded from high or critical to medium, producing the reported reduction in pages.
Figma then added an agentic layer using Tines. An initial model routes requests to specialized agents, each with its own instructions, authorization and limited tools. The principal agent can inspect identity records, endpoint events, cloud resources, Slack threads and Panther data. For deeper searches, it delegates to a sub-agent that translates natural-language questions into Snowflake SQL.
Memory is not one thing
Figma separates what it calls case, steering and procedural memory. It also maintains database-backed operational state, effectively creating a fourth category.
Case memory contains previous alerts and the conclusions reached by engineers. It functions as precedent: what happened in a similar situation, what evidence mattered and how the incident was resolved.
Steering memory contains behavioural guidance loaded at the beginning of each run. If an engineer corrects the agent, the system can preserve that correction for later investigations.
Procedural memory records operational knowledge acquired while completing tasks. Because Figma’s security tables have inconsistent names, joins and time fields, the SQL agent could spend four or five queries discovering a table’s structure. It now saves schema discoveries, sometimes reducing a subsequent investigation to one query.
Stable records also track open pull requests and investigation status as explicit state with durable identifiers.
That separation matters because Figma has already experienced memory contamination. The company initially saved too many one-off lessons in steering memory. Specific precedents then began overriding the agent’s general behaviour in unwanted situations. As Figma puts it, precedent and policy are different things and belong in different places.
This demonstrates an emerging enterprise problem: a system that remembers does not necessarily learn correctly. Organizations must decide which information is authoritative, how broadly it applies, who may change it and how it can be revoked.
Autonomy should follow consequence
Figma’s most consequential design choice is to place safeguards in the tool layer rather than relying on prompt instructions.
Every pull request created by the agent is automatically designated as a draft through a deterministic workflow step. The agent cannot close or modify pull requests it did not author. Access to Okta information is filtered, tools are independently authorized and monitored, and the agent cannot roam through entire Slack channels. It may read a thread only under defined conditions.
Figma says it is more comfortable granting autonomy when an action is bounded, reversible and supported by clear evidence. Read-heavy investigation, duplicate detection, precedent retrieval and draft remediation qualify. Broad, destructive or difficult-to-audit write access does not.
That is a much more useful enterprise model than asking whether an agent is simply “autonomous.” Autonomy is allocated according to the significance and reversibility of a particular action. The system may have considerable freedom to search and reason, less freedom to alter alert severity and no independent authority to merge a code change into production.
The harness, tools, permissions and review requirements ultimately determine what the agent can do.
Impressive results, incomplete evidence
Figma’s reported performance deserves attention, but not unqualified acceptance. The company does not provide the number of alerts included in its 70 percent time-reduction figure, the measurement period, the baseline distribution or a definition of “complex.” It also reports the reduction in on-call pages without publishing a false-downgrade rate or the number of serious incidents the system may have classified incorrectly.
Those omissions make it impossible to determine whether it improved security outcomes or primarily operational efficiency.
There are also unresolved memory-governance questions. Figma does not fully explain how learned schema mappings are validated, aged or updated when databases change. Nor does it detail how contradictory memories are resolved, how global steering corrections are approved or how poisoned context is prevented from entering the feedback loop.
The company openly acknowledges that this work is unfinished. Its next priorities include better distinctions among precedent, policy and state, stronger provenance and moving trusted workflows out of prompt behaviour and into deterministic, inspectable automation.
The enterprise lesson
The structure, capability and blending of functions is interesting in and of itself, especially when compared to other systems and to incidents of agents gone “rogue”. Rather than treating unsanctioned activity as a bug, Sigma’s overseeing function treats it as almost foregone conclusion and plans against it. (to be clear this is not high consequence software, so the risk is low consequence one of the reasons why this is an ideal scenario to observe.)
| It sits above Figma’s various platforms | Mostly | It is a security-orchestration layer built over Panther, Figma’s SIEM. It can query many internal systems through restricted tools, including AWS, GCP, Okta, GitHub, endpoint systems, Wiz and roughly 100 security-data tables. |
| It also oversees Figma’s operational AI systems | Not established | Figma does not say it supervises its product AI or other business agents. It investigates security events across internal infrastructure. An AI system could theoretically be among the monitored sources, but that is not documented. |
| It is separate from the AI used to run the business | Yes | This is a specialized security-agent system using its own workflows, models, memory and permissions. It is not simply Figma’s product agent being given security duties. |
| It provides a check against originating problems | Yes, broadly | Panther detects a possible problem; the agent investigates whether it is malicious, benign, duplicative or already being fixed. The problems are not specifically AI-generated. They can originate in identity systems, employee devices, cloud infrastructure, code changes or SaaS tools. |
| Figma created an ontology or taxonomy of incidents | Partly | It created a structured alert schema, an intent-routing taxonomy and a precedent corpus. It records fields such as alert type, actor, IP address, account, severity, tags and time. However, Figma does not describe a formal ontology of incident entities and relationships. |
| Agents take actions based on those categories | Mostly | Classification routes each case to an agent with an appropriate tool set. The agent then investigates the evidence and may downgrade an alert, recommend action or create a draft PR. Classification alone does not authorize the action. |
| Humans enter when a security threshold is reached | Not exactly | Humans are in the workflow from the beginning because alerts and agent findings appear in Slack and Asana. Figma does not describe a single escalation threshold. Humans review consequential outputs, particularly code changes and ambiguous investigations. |
| The agentic overseer cannot intervene in production | Partly | It cannot directly merge or deploy its code fixes. Every agent-authored PR is mechanically forced into draft status. But the system does have limited operational authority, including querying sensitive security data and automatically downgrading some alerts. |
The story becomes more significant alongside a separate Figma disclosure about agents reviewing its code. The company says it runs both Claude Code and Codex because the two systems miss different vulnerabilities. On a corpus of 66 real flaws that had previously escaped human reviewers and traditional static analysis, their combined catch rate reached 75.8 percent. Figma also found that supplying its own precedent-based security policy materially improved performance over asking the model simply to find vulnerabilities.
Together, the two systems illustrate where enterprise agents may be heading. The differentiator is not just access to a powerful model. It is the organizational knowledge surrounding the model, the division of that knowledge into appropriately governed memory, and a control plane that limits authority according to consequence.
Figma has not built an infallible autonomous security engineer. It has built a system in which agents perform high-volume investigation and draft remediation while people retain authority over consequential changes.
That is less spectacular than an AI independently running security. It is also far more credible, and much more likely to become the enterprise pattern.
Sources: Figma’s internal security-agent architecture and Figma’s agentic code-security system.
