How Figma Stays Ahead of Vulnerabilities With Agents | Figma Blog

For the past year, agents at Figma have guarded code as it's written, reviewed every pull request, and audited a decade-old monorepo, all on one policy.

Precision is the share of reported findings that are real vulnerabilities. High precision implies low false positives. Recall is the share of real vulnerabilities the system catches. High recall implies low false negatives. Pointing coding agents at the codebase and asking them to find vulnerabilities is simple. Getting the precision and recall an organization needs is still hard engineering: How many findings are legitimate, and how many actual bugs does the system catch? This post walks through how we approach precision, recall, and trust when it comes to running agentic security for…

saved by

• Senthilnathan Thirumurugan
• Mahendra Dani

related reading

• Why We Built Our Own Background Agentbuilders.ramp.com
• Vulnerability Research Is Cooked - Quarrelsomesockpuppet.org
• Demystifying evals for AI agents \ Anthropicanthropic.com
• How coding agents read your code (and how to write for them)modem.dev
• Annotating for agentsbenji.org
• Teaching agents product design at Vercel - Vercelvercel.com
• Harness design for long-running application developmentanthropic.com
• A Practical Approach to Verifying Code at Scalealignment.openai.com
• AI is approving our pull requests: Here’s how we made it safeintercom.com
• Best practices for using AI coding Agents | Augment Codeaugmentcode.com
• AuditAgentauditagent.nethermind.io
• Designing agentic loopssimonwillison.net