AI delivery process as attack surface

Encrypting locally stored AI data is not sufficient if the OS process that receives decrypted content is weaker or accessible: attackers can inject into non‑privileged host processes (here, AIXHost.exe) and capture screenshots, OCR text, and metadata after a legitimate user authenticates. This creates a persistent, low‑privilege side channel that survives sessions and sidesteps vault encryption without bypassing user authentication directly. — Highlights a new class of security risk — the 'delivery truck' vulnerability — that should reshape how vendors, regulators, and auditors evaluate on‑device AI privacy guarantees.