AI-native attacks walk past legacy security.

The most consequential attacks on AI contain no code. An instruction is planted in something an AI will read, a contract sent for summary, a web page, an email in the inbox it manages, and the AI follows it. Aimed at people, this is social engineering, and every company trains against it. AI brought a version that works on software. A model does what the text it reads convinces it to do, and anything that can get words in front of it can try to give it orders.

The security stack in place today was built on one quiet assumption, that content does not act. So controls read the outside of things, destination, file type, known signatures, volume, the way a postal scale weighs an envelope. The injected instruction can pass every one of those checks. It is new wording each time, bound for the company's own AI, in a permitted format, at normal volume. The harm is in what the words ask, and no scale reads the letter.

A control that reaches this attack has four properties. It sees the whole conversation, because the hostile sentence can hide in any part of it. It judges meaning and intent, not pattern matching alone. It rules before the AI acts and at every turn after, because instructions can arrive at any point in the exchange. And it keeps learning, because attackers use AI of their own to write new wordings weekly. No fixed system meets all four. Threats that reason require a defense that reasons. AI built for judgment, standing in the path of every interaction.

Neither kind of defense replaces the other. A rule answers yes-or-no questions instantly, identically every time, and cannot be talked out of its decision; no wording of a request persuades it. But no rulebook can list every way a sentence might ask for something it should not get. And judgment, because it is judgment, needs hard limits around it. A hard block holds no matter what the judge concludes. Banks already run this arrangement. The transfer limit is a rule, the confirmation callback is judgment, and neither is considered safe alone.

The conversation an AI reads comes together where the AI is used. At the endpoint, in the workspace apps where people write, and at the connection to the model. From the network a control sees fragments and encrypted traffic; a guard at the parking garage cannot overhear the meeting rooms. And bolting a reasoning module onto equipment built for pattern-matching leaves the old blind spot where it was. Systems get this shape by being designed for it.