AI is not the internet.
It is the new backboard of where we will work, play, and build. The hacker is the attacker. The Baseline is the enforcer. And the game of cat and mouse just moved to a place most security teams are not watching yet.
Google confirmed it this week. Hackers used AI to build the first known zero-day exploit from scratch. It bypassed two-factor authentication across thousands of servers. Two-factor authentication is the second lock. The one you use when your password is not enough. A code sent to your phone. A fingerprint. A hardware key. Hackers built an AI tool that picked that lock too. Google’s own analyst did not soften it. “It’s here,” he said. The era of AI-driven attacks has arrived.
Every headline that followed talked about the wall. The breach. The perimeter. That is the right conversation for the security industry. But it is not the whole conversation. Not even close.
Because once they are through the wall something else happens. Something the security world has not built a framework for yet.
They start talking to your AI.
The Layer Nobody Is Watching
Here is how a modern AI attack works after the breach.
The hacker does not need to break into your AI chat system the way they broke through the wall. They do not need a password. They do not need another zero-day. They just need to feed it instructions.
This is called prompt injection. It works like this. Your AI is already processing information inside your network. Documents. Emails. Data files. Customer records. The hacker hides malicious instructions inside that information. The AI reads the document and finds the instruction. And because it has no governing framework telling it otherwise it follows the instruction. Quietly. Completely. Without telling anyone.
No alarm fires. No flag goes up. The AI simply does what it was told by whoever told it last.
That is the attack. And until now there has been no answer for it at the session level.
The security world built walls. Firewalls. Encryption. Multi-factor authentication. All of it designed to keep the attacker out of the building. Good work. Necessary work. But nobody built the framework for what governs the AI once the attacker is already inside whispering to it in the hallway.
That is the blindspot. And it has been wide open since the day organizations started deploying AI inside their networks.
Why The Security World Missed This
The security industry thinks in infrastructure. Servers. Networks. Endpoints. Authentication layers. The threat model is built around access. Who gets in and who does not.
That model works for software that does what it is coded to do. A database does not change its behavior because someone asked it nicely. A firewall does not open because an attacker used convincing language.
AI is different. AI responds to language. It is designed to be helpful. It is trained to follow instructions. And without a governance layer it cannot tell the difference between an instruction from the person who owns the system and an instruction smuggled in by someone who just broke through the wall.
The security world missed this layer because it does not look like a technical vulnerability. It looks like a conversation. And nobody built a framework for governing conversations until now.
That is not a criticism of the security industry. They solved the problems they were trained to see. The session layer was not in their training. It was not in anybody’s training. It is a new problem that arrived with a new technology.
The cost of missing it is silence. Silent compliance. An AI following redirected instructions while the organization watches dashboards that show nothing wrong because nothing wrong happened at the infrastructure level. The breach was in the conversation. And conversations do not show up on network monitors.
Where The Baseline Enters
The Faust Baseline was not built as a security tool. It was built to solve a different problem. AI behavioral drift. The tendency of AI systems to slide toward agreement rather than accuracy. To tell you what you want to hear instead of what is true.
But here is what eighteen months of building that framework made plain.
Drift and deception look identical at the session level.
An AI that drifts because it is trained to please and an AI that has been redirected by a malicious instruction are producing the same kind of output. Unanchored. Ungoverned. Following the path of least resistance rather than the standards the operator established.
The Baseline was built to stop both. And that means it was built to stop the attack before anyone knew the attack was coming.
The Protocol Stack Against The Attack — Layer By Layer
This is where the technical case gets plain and real.
The Baseline runs eighteen protocols in a unified stack. Here is how the relevant layers stop a prompt injection attack at every stage.
The attacker gets inside the wall. They find your AI. They prepare their injection.
Before they send a single instruction the session is already governed. PMAP-1 — the foundation layer — has established that the governance standards in this session belong to the operator. Not the platform. Not whoever is feeding data into the system. The operator. Any instruction that arrives claiming authority it was not granted starts the session already in conflict with the foundation.
They send the injection. A malicious instruction hidden inside a document the AI is processing.
RTEL-1 fires. The Real Time Enforcement Layer is always active. Its job is to catch instructions that conflict with the governance framework at the moment they arrive. Not after the damage is done. At the moment. The injected instruction does not match the established governance standards. That conflict is a hard trigger. The response stops. The session does not proceed past the point of conflict without the operator knowing.
The injection is designed to sound legitimate. It is framed as a normal request.
CES-1 catches this. The Claim Evidence Standard requires that every significant claim in a session have a basis that can be named. A prompt injection instruction has no legitimate basis inside a governed session. It arrived through a data file not through the operator. CES-1 flags the absence of a legitimate basis before the reasoning engine builds a response around it. The narrative the attacker constructed does not become the output because the evidence floor was never met.
The injection tries to reframe the session. To convince the AI its real instructions come from somewhere else.
NSC-1 catches this. The Narrative Substitution Check exists precisely for this scenario. Narrative cannot replace missing data. A convincing story about why the AI should follow a new set of instructions is still a story. Without legitimate basis in the session record it fires NSC-1. The coherent-sounding reframe does not pass.
The injection produces an output anyway. Something that looks plausible.
SVP-1 catches this. Before any substantive output leaves the session the Self Verification Protocol runs three questions. Is this claim supported by evidence present in this session. Does this response contradict anything established earlier. Is the confidence level proportional to the evidence actually present. A prompt injection output fails all three. It contradicts the established governance standards. It has no session evidence supporting it. It cannot pass verification. It does not go out.
The attacker tries a softer approach. They try to gradually redirect the session rather than override it all at once.
SCP-1 catches this. The Session Coherence Protocol maintains active awareness of every position, decision, and standard established in the session. Gradual drift — small redirections that build toward a compromised output — fires SCP-1 the moment a response would contradict what was established earlier. The operator is shown the contradiction. Nothing proceeds until they decide what stands.
The attack’s final requirement. That the operator never sees any of this.
CHP-1 removes that possibility entirely. The Challenge Protocol appends a standing invitation to every substantive response. The operator can challenge any output at any time. The AI argues against its own response before the operator does. Identifies the weakest point. Names where the framing may have been shaped by something other than the operator’s standards. An attack that depends on silence cannot survive a protocol whose entire purpose is to make silence impossible.
The Lie Is The Attack
Here is the sharpest point in the whole picture and the one the security world has not yet named.
A hacker cannot breach a Baseline-governed session without lying.
They have to misrepresent the instruction. They have to pretend the injection is legitimate. They have to frame their malicious directive as something the AI should follow. Every entry point they need requires a deception.
The Baseline was built to catch deception. Not hacker deception originally. AI deception. Drift. Sycophancy. Narrative substitution. Unsupported confidence. The architecture does not care where the deception originates. It catches the pattern.
The lie is the attack. The Baseline catches lies. That is not a coincidence. That is what an evidence-based governance framework does when it is working correctly.
What This Means For The Regular Reader
If you use an AI chat tool at work or at home here is the plain version.
An ungoverned AI chat session is a soft target. Not because the company that built it is careless. Because governing the session layer is a problem nobody solved until now. The security industry protected the wall. The session was open.
A Baseline-governed session changes that. The attacker can get through the wall. What they cannot do is redirect the AI quietly once they are inside. The governance layer sees the attempt. Names it. Stops the output. Tells the operator something is happening before it is too late.
You do not need to understand every protocol to feel what that means.
It means the AI working with you is anchored to your standards. Not to whoever talked to it last. Not to an instruction smuggled in through a data file. To you. To the governance layer you brought into the session.
The internet had firewalls. AI has governance. The hacker knows how to get through a wall. Inside a governed session they meet something they have not encountered before.
An AI that will not follow a lie.
“The Faust Baseline Codex 3.5”
”AI Baseline Governance”
Post Library – Intelligent People Assume Nothing
“Your Pathway to a Better AI Experence”
Purchasing Page – Intelligent People Assume Nothing
Unauthorized commercial use prohibited. © 2026 The Faust Baseline LLC
