HOW FIGMA STAYS AHEAD OF VULNERABILITIES WITH AGENTS

Summary from the TLDR InfoSec newsletter

Figma uses agents to review PRs for vulnerabilities, audit existing repositories, and generate secure code. When writing the workflow to review PRs, Figma found that the collection of policies and precedents that they wrote to improve precision constituted a detailed threat model for the agent to follow. This threat model was also utilized with more agents to brute force a code audit of a large, legacy monorepo and is used with agent hooks for secure code generation.