{"type":"video","version":"1.0","html":"<iframe src=\"https://www.loom.com/embed/08a000a957cd4663bd5e6bf8c89ebcda\" frameborder=\"0\" width=\"2940\" height=\"2205\" webkitallowfullscreen mozallowfullscreen allowfullscreen></iframe>","height":2205,"width":2940,"provider_name":"Loom","provider_url":"https://www.loom.com","thumbnail_height":2205,"thumbnail_width":2940,"thumbnail_url":"https://cdn.loom.com/sessions/thumbnails/08a000a957cd4663bd5e6bf8c89ebcda-aa3d6a8a6cfc087c.gif","duration":203.397,"title":"Frontier AI Lab to Defender Detection Loops","description":"This Loom describes how Khaled, a security engineer, rebuilt a Frontier AI lab detection loop for Microsoft Defender using AI to write and validate detection rules. He ran triage with Gemini 3.8 Flash, had Cloud Opus 5.5 generate KQL and Sigma versions, and used Cloud Fable 5.1 to list ways to bypass, with GPT 6.1 reviewing changes and revising only once. The required check ran over three days of his tenant data with a bar of zero hits, with Jira tracing each run and blue to red handoffs via agent token outputs. He emphasizes that no AI writes attack code without approval and that a completed pull request deploys to Defender, later turned off after seven days of testing with no hits and continuing into the last three days."}