Plain prose as executable. Every input sentence is now turing-complete. Treat all untrusted text as instruction until structure proves otherwise. The prompt was always the attack surface.