Figma warns of cybersecurity risks including prompt injection, AI vulnerability discovery, and supply-chain compromises via AI agents.
“We face evolving cybersecurity risks that threaten the confidentiality, integrity, and availability of our or our customers’ confidential or personal data and our and our third-party service providers’ information technology systems, which could result from human error, system misconfiguration, or from cyber-attacks, including distributed-denial-of-service attacks, reverse-engineering of AI algorithms, prompt injection attacks, automated reconnaissance, web scraping, ransomware attacks, business email compromises, credential stuffing, computer malware, viruses, and social engineering (including phishing, deepfakes, and voice cloning), software supply-chain compromises, including but not limited to via AI agents, templates, designs, icons, widgets, plugins, or other third party software or content, malicious code embedded in open-source software, or misconfigurations, “bugs” or other vulnerabilities in commercial software that is integrated into our and our third-party service providers’ information technology systems, products or services, which are prevalent in our industry. Recent advancements in AI have demonstrated the potential for AI systems to autonomously discover and exploit software vulnerabilities, including zero-day vulnerabilities, at speeds and scales that exceed previous human capability, which may materially accelerate the timeline and severity of potential attacks. These threats may come from a variety of sources, including nation-state sponsored espionage an”