AI threats require intelligent systems

Almost every consumer protection product in common use rests on the same idea: keep a list of things known to be bad, and check what the user encounters against it. That works when building a convincing fake site takes effort and time, because effort and time mean each attack is reused often enough to be reported, verified and distributed to defenders.

Generation removes that constraint. A convincing login page, delivery notice, invoice or support chat can be produced, hosted on a fresh domain, used against a small group of people and abandoned before anyone submits a report. The list is not wrong, it is simply describing a different set of attacks from the one in front of the person right now.

The browser is where the whole attack lands. It opens the link, renders the page, holds the saved credentials, autofills the address and card, and receives the download. It is also the only component that sees those steps as one continuous session rather than as unrelated events, which makes it the natural place to reason about intent.

Reasoning about intent means reading a page the way a careful person would. A form that asks for a banking password on a domain registered this week, styled as a brand it has no relationship with, is suspicious on its structure and behaviour alone, with no report filed anywhere. The same applies to a link whose visible text names one destination while its target resolves to another, to a page that recreates a familiar sign in flow inside an overlay, and to a checkout that collects card details outside a payment processor.

Search is the step before the click, which makes it the cheapest place to prevent harm and the most profitable place to cause it. When placement is sold, the results that appear first are the results someone paid to put there, and a scam that can afford the placement inherits the trust that position carries. Fake support numbers, cloned download pages and imitation brand storefronts have all been distributed this way.

An AI assisted search layer changes what is possible, in both directions. It can read candidate destinations, recognise that a page claiming to be an official download is not hosted by the vendor, and say so before anyone visits. It can also be tuned to keep people circling inside a monetised loop. The difference is not technical sophistication, it is whose interest the ranking is built to serve, and that is a design decision a company either publishes or hides.

File scanning was a good match for a world where threats arrived as programs on disks and attachments. Modern consumer harm mostly does not arrive as a file at all. It arrives as a page that asks for a code from an authenticator app, a browser notification that imitates a system alert, an extension with more permissions than its purpose needs, a session token stolen from a tab, or a persuasive conversation that ends with a bank transfer the victim makes themselves.

None of that is a signature on disk. A scanner can be flawless and still be absent for the entire attack, because nothing it inspects was ever involved. Endpoint protection still matters for the file paths that remain, and it needs to be paired with something that watches the web session where the majority of incidents now begin and end.

The point of routing traffic through a provider is to remove the local network and the internet provider from the list of parties who can see where you go. It only works if the provider does not simply become that party. A service that records which sites an account visited, and when, has moved the record rather than removed it, and that record can be requested, subpoenaed, sold or stolen.

The honest version of the promise is architectural, not rhetorical. Do not retain browsing destinations. Keep account records separate from traffic handling so activity cannot be tied back to a person. Publish what is kept, for how long, and what happens when a request arrives. A privacy claim that could not survive a subpoena was never a privacy claim.

The most sensitive part of a modern session is no longer a stored file, it is text. People paste contracts, medical notes, customer records, salary details and credentials into assistants because that is how the tool is useful, and agents read pages and documents on their behalf with no pause to consider what those pages contain. Once that text is submitted it has left the device, and the person has no further control over how long it is kept or what it trains.

A privacy intent layer sits between the person and the model and decides what is allowed to leave, before it leaves. It recognises identifiers, secrets and confidential material in a prompt or an attachment, offers to remove or replace them, keeps work local where a local model is sufficient, and asks for confirmation before an agent sends anything sensitive outward. This is the missing piece of consumer protection: the mechanism that treats the model itself as an outside party, and asks whether this particular sentence needs to reach it at all.

Intelligent is worth very little as a claim, so it needs to be readable as behaviour. Protection that reasons rather than looks up should be able to act on a threat nobody has reported, work the same way for a person who never opens a settings screen, and say plainly what it found when it interrupts them. It should also state what it does not cover, because every layer has an edge and the moment something slips past is the moment vague promises turn into distrust.

The layers reinforce each other when they share what they see. Search warns before a page opens, the browser judges the page that loads and the form on it, endpoint protection handles what reaches the device, the network layer keeps the route private, and the privacy intent layer governs what any of it sends to a model. Each one is useful alone. Together they cover the path a real incident actually takes.