Amendment to Amended and Restated Capital on Demand Sales Agreement, dated July 29, 2019, by and among Infinity Pharmaceuticals, Inc. and JonesTrading Institutional Services LLC and B. Riley Securities, Inc. (f/k/a B. Riley FBR, Inc.), dated July 27, 2021

JonesTrading Institutional Services LLC

757 Third Avenue, 23rd Floor

New York, NY 10017

B. Riley Securities, Inc.

299 Park Avenue, 21st Floor

New York, NY 10171

    

Ladies and Gentlemen:

Reference is made to the Amended and Restated Capital on DemandTM Sales Agreement, dated as of July 29, 2019 (the “Sales Agreement”), by and among Infinity Pharmaceuticals, Inc., a Delaware corporation (the “Company”), and JonesTrading Institutional Services LLC and B. Riley Securities, Inc. (f/k/a B. Riley FBR, Inc.) (the “Agents”), pursuant to which the Company agreed to sell through the Agents, as sales agents, shares of the Company’s common stock, par value $0.001 per share (the “Shares”). All capitalized terms used in this Amendment No. 1 to the Amended and Restated Capital on DemandTM Sales Agreement (this “Amendment”) not otherwise defined herein shall have the respective meanings assigned to such terms in the Sales Agreement. The Company and the Agents agree as follows:

A.Amendments to Sales Agreement.

1.The first and second paragraphs of Section 1 of the Agreement shall be amended and restated as follows:

The Company has filed, in accordance with the provisions of the Securities Act of 1933, as amended and the rules and regulations thereunder (the “Securities Act”), with the Commission registration statements on Form S-3 (File Nos. 333-230258 and 333-256096), each including a base prospectus, relating to certain securities, including the Placement Shares to be issued from time to time by the Company, and which incorporate by reference documents that the Company has filed or will file in accordance with the provisions of the Securities Exchange Act of 1934, as amended, and the rules and regulations thereunder (the “Exchange Act”). The Company has prepared a prospectus supplement to the base prospectus included as part of each registration statement, which prospectus supplement relates to the Placement Shares to be issued from time to time by the Company (the “Prospectus Supplement”). The Company will furnish to the Agents, for use by the Agents, copies of the prospectus included as part of such registration statement, as supplemented by the Prospectus Supplement, relating to the Placement Shares to be issued from time to time by the Company. The Company may file one or more additional registration statements from time to time that will contain a base prospectus and related prospectus or prospectus supplement, if applicable (which shall be a Prospectus Supplement), with respect to the Placement Shares. Except where the context otherwise requires, such registration statement(s), including all documents filed as part thereof or incorporated by reference therein, and including any information contained in a Prospectus (as defined below) subsequently filed with the Commission pursuant to Rule 424(b) under the Securities Act or deemed to be a part of such registration statement pursuant to Rule 430B of the Securities Act, is herein called the “Registration Statement.” The base prospectus or base prospectuses, including all documents incorporated therein by reference, to the extent such information has not been superseded or modified in accordance with Rule 412 under the Securities Act (as qualified by Rule 430B(g) of the Securities Act), included in the Registration Statement, as it may be supplemented, if necessary, by the Prospectus Supplement, in the form in which such prospectus or prospectuses and/or Prospectus Supplement have most recently been filed by the Company with the Commission pursuant to Rule 424(b), together with the then issued Issuer Free Writing Prospectus(es) (as defined below), is herein called the “Prospectus.”

2.Section 6(v) of the Agreement shall be amended and restated as follows:

3.New Section 6(zz) and (aaa) shall be added as follows:

(zz)   Cybersecurity.  Except as would not, individually or in the aggregate, reasonably be expected to result in a Material Adverse Effect, the Company and its Subsidiaries’ information technology assets and equipment, computers, systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) are adequate for, and operate and perform in all respects as required in connection with the operation of the business of the Company and its Subsidiaries as currently conducted, free and clear of all bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants. The Company and its Subsidiaries have implemented and maintained commercially reasonable physical, technical and administrative controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, continuous operation, redundancy and security of all IT Systems and data, including “Personal Data,” used in connection with their businesses.  “Personal Data” means (i) a natural person’s name, street address, telephone number, e-mail address, photograph, social security number or tax identification number, driver’s license number, passport number, credit card number, bank information, or customer or account number; (ii) any information which would qualify as “personally identifying information” under the Federal Trade Commission Act, as amended; (iii) “personal data” as defined by GDPR (as defined below); (iv) any information which would qualify as “protected health information” under the Health Insurance Portability and Accountability Act of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act (collectively, “HIPAA”); and (v) any other piece of information that allows the identification of such natural person, or his or her family, or permits the collection or analysis of any data related to an identified person’s health or sexual orientation. To the Company’s knowledge, there have been no breaches, violations, outages or unauthorized uses of or accesses to same, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same. The Company and its Subsidiaries are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification.

(aaa)     Compliance with Data Privacy Laws. The Company and its Subsidiaries are, and at all prior times were, in material compliance with all applicable state and federal data privacy and security laws and regulations, including without limitation HIPAA, and the Company and its Subsidiaries have taken commercially reasonable actions to prepare to comply with, and since May 25, 2018, have been and currently are in compliance with, the European Union General Data Protection Regulation (“GDPR”) (EU 2016/679) (collectively, the “Privacy Laws”). To ensure compliance with the Privacy Laws, the Company and its Subsidiaries have in place, comply with, and take appropriate steps reasonably designed to ensure compliance in all material respects with their policies and procedures relating to data privacy and security and the collection, storage, use, disclosure, handling, and analysis of Personal Data (the “Policies”). The Company and its Subsidiaries have at all times made all disclosures to users or customers required by applicable laws and regulatory rules or requirements, and none of such disclosures made or contained in any Policy have, to the knowledge of the Company, been inaccurate or in violation of any applicable laws and regulatory rules or requirements in any material respect. The Company further certifies that neither it nor any Subsidiary: (i) has received notice of any actual or potential liability under or relating to, or actual or potential violation of, any of the Privacy Laws, and has no knowledge of any event or condition that would reasonably be expected to result in any such notice; (ii) is currently conducting or paying for, in whole or in part, any investigation, remediation, or other

corrective action pursuant to any Privacy Law; or (iii) is a party to any order, decree, or agreement that imposes any obligation or liability under any Privacy Law.

4.Schedule 1 is amended by (i) deleting “B. Riley FBR, Inc.” and inserting in lieu thereof “B. Riley Securities, Inc. (f/k/a B. Riley FBR, Inc.)” and (ii) adding “as amended on July 27, 2021” immediately after “July 29, 2019”.

5.Exhibit 7(l) is amended by adding “as amended on July 27, 2021” immediately after “July 29, 2019”.

B.Expenses. Pursuant to Section 8 of the Agreement, the Company shall pay the reasonable and documented fees and expenses of the Agents incurred in connection with the negotiation and execution of this Amendment including but not limited to the reasonable and documented fees and disbursements of the counsel to the Agents payable upon the execution of this Amendment, in an amount not to exceed $35,000.

C.Prospectus Supplement. The Company shall file a Prospectus Supplement pursuant to Rule 424(b) of the Securities Act reflecting this Amendment within two Business Days of the date hereof.

D.Existing Sales Agreement. Notwithstanding anything to the contrary contained herein, this Amendment shall not have any effect on the terms of the Sales Agreement prior to the date of this Amendment, and the rights and obligations of the parties thereunder, including, without limitation, the representations, warranties and agreements (including the indemnification and contribution provisions), as well as the definitions of “Registration Statement” and “Prospectus” contained in the Sales Agreement.

E.No Other Amendments. Except as set forth in Part A above, and except for any waiver or amendment of any provision of the Sales Agreement after the date hereof, all the terms and provisions of the Sales Agreement shall continue in full force and effect. All references in the Sales Agreement to the “Agreement” shall mean the Sales Agreement as amended by this Amendment; provided, however, that all references to “date of this Agreement” in the Sales Agreement shall continue to refer to the date of the Sales Agreement.

F.Counterparts. This Amendment may be executed in two counterparts, each of which shall be deemed an original, but all of which together shall constitute one and the same instrument. Delivery of an executed Amendment by one party to the other may be made by facsimile or by electronic delivery of a portable document format (PDF) file (including any electronic signature covered by the U.S. federal ESIGN Act of 2000, Uniform Electronic Transactions Act, the Electronic Signatures and Records Act or other applicable law, e.g., www.docusign.com).

G.Governing Law. This Amendment shall be governed by, and construed in accordance with, the laws of the State of New York without regard to the principles of conflicts of laws.

If the foregoing correctly sets forth the understanding among us, please so indicate in the space provided below for that purpose.

Very truly yours,