AI security threats have pivoted from models to workflows, exposed by Chrome extensions stealing data from 900,000 users and persistent prompt injections. Enterprises must prioritize ecosystem defenses to counter these evolving risks.