Figma and Google Cloud both published how they use AI agents to secure their own code this year. The machinery is cheap and the method is documented. What neither company can sell you is the written threat model that makes it work.