Figma runs security agents across three stages: code generation, pull request review, and monorepo-wide auditing. On a 66-task evaluation corpus made only of bugs that had already slipped past human reviewers plus SAST, the dual-model PR reviewer catches 75.8% (union recall), at a median cost of about $0.50 per PR review. All three stages share a precedent-based policy (99 lines, 2,560 words, 68 precedents), and PR review runs on a dual-model setup (Claude Code Opus 4.8 + Codex GPT-5.6 Sol) for union recall.
"We had written a complete threat model, in roughly the form we'd want a new hire to read on day one. The policy is the threat model," wrote Rohan Sharma, Liam Buchan, and Dave Martin on Figma's engineering blog on July 23, 2026.
Even with human code review and SAST, real vulnerabilities slip into production and surface only via HackerOne reports, internal incidents, or audits. Figma's security team found that pointing coding agents at code to find vulnerabilities is easy; getting the precision and recall an organization needs is still hard engineering.
Figma shipped the Claude Code Security Reviewer into shadow mode the day Anthropic released it in August 2025; week-one precision was 15% (4 of 27). Hand-labeling false positives over eight weeks of past PRs and writing the precedent-based policy pushed precision to 80% within a month, clearing the team's 70% bar; by December 2025 the team had rebuilt the reviewer as a TypeScript service and added an adjudicator that re-examines borderline dismissals. They later moved from Opus 4.7 to 4.8, trading a small precision dip for better multi-step exploit recall.
The architecture is dual-model: Claude Code on Opus 4.8 plus Codex on GPT-5.6 Sol, each running independently. Both share the same precedent-based policy. PR review runs as a TypeScript service with provider failover so a model-vendor outage cannot let a PR slip through unreviewed. Code generation and repo-wide auditing both run on the same policy, so the threat model is never built twice.
Recall is measured via an eval corpus of 66 tasks (46 from HackerOne, 20 from internal incidents), each run in isolated Git worktrees. With the full policy, Claude Code alone catches 64.2% on payout weight; ablated, it drops to 44.4%. Precision is measured in production because findings are too rare to hand-label: a separate agent re-reads disputed findings and escalates contested ones to security on-call. Trust boundaries are enforced — a read-only validation agent screens for prompt injection, fix-writing runs in an isolated sandbox, agent-generated CI lacks deploy credentials, and merges require human review, SAST, and the agentic pass.
Self-improvement loops feed policy updates both ways. For recall, an escaped HackerOne bug traces to its root-cause commit, joins the eval corpus, and updates the policy until the reviewer catches the next bug of that type. For precision, a thumbs-down from a PR author triggers a loop that suppresses that class of false positives. Going forward, code generation and monorepo-wide auditing share the same evolving threat model.