In harness-is-the-os-of-the-intent-stack, the privilege rings (system prompt = ring 0 … tool/web returns = ring 3 untrusted) are conventional, not architecturally enforced — there is no MMU in attention. So injected instructions in untrusted content execute with ambient authority: the von Neumann curse (no code/data distinction) replaying in natural language, and harder, because NL has no syntax separating the two.
Historical placement: "we're between 1988 and 2004 — we have canaries (boundary sanitization), but no NX bit." The Morris worm (1988) opened the security epoch; the hardware NX-bit fix took until 2004 — 16 years. The structural fix likely rhymes with Android's manifest model: a skill declares the capabilities it needs, and the harness manifest enforces them, instead of userland code carrying ring-0 instructions ("always run this command").
Up: vibe-linter