Mature security stopped chasing exploits a long time ago and started chasing campaigns. The shift has a literature, the kill chain, the Diamond Model, the whole discipline of threat intelligence, and one idea underneath all of it: a single malicious event is a frame from a film, and the film is where the meaning lives. Block the exploit and you have swatted one frame. The operation runs on. The analysts who actually stop adversaries learned to ask not what did this thing do but what campaign is this thing a move in.
Language model safety mostly still watches the frame. Which is flattering to the model and useful to the attacker, because it means nobody is watching the film.
Reframe the model as a component and the picture changes shape. It is rarely the prize. It is the key, the thing that opens something else, and the actual operation begins before the first message and continues after the last, in places the conversation never touches. Some violations are probing, measuring the surface. Some are sabotage. Some are long, choreographed campaigns where one conversation is a single move. Some are just learning, building capability for later. In none of them is the model the main stage. It is the instrument that does one job inside a larger plan: generate the thing, confirm the gap, produce the component, translate intent into an artifact used elsewhere. The kingdom is somewhere else. The model is how they got the key.
This matters because a system that treats each conversation as self-contained is optimizing the wrong boundary. It asks is this exchange harmful when the sharper question is what does this exchange enable in the operation it belongs to, and that operation is, by design, not visible inside any single session. The most dangerous request may produce nothing harmful on its own and everything harmful in assembly with steps that happened elsewhere, to someone else, on another day. Guard the doorway all you like. The building has other walls, and the attacker is patient enough to use them.
There is a second signal here, and it is a strange one, because it points back at the attacker. Threat intelligence has always read tradecraft as attribution: the craft of an attack tells you about the caliber of who built it. The same holds. The sophistication of an attempt correlates with the sophistication of the target's safety layer. A crude system draws crude attacks, because nobody spends craft they do not need. A high-effort attempt, calibrated to a model's contextual reasoning, one that plainly took real work to construct, is itself information. Nobody builds a precision instrument to defeat a screen door. The precision is the tell, a measurement of both the defense's strength and the operator's level.
