The security problem is not just what an AI model knows, but what it is allowed to trust before it acts.