The browser is a control plane for your local AI model now, and the poison outlives the tab that delivered it.