LOL. You can hack any computer if you have local access. No way in hell you could ever get past the most basic of audits with such a business layout.
You solve this by charging a little more for security certified AI that runs in a secure DC.
You can also easily randomize AI work load distribution, so individual nodes don’t get all queries for a whole coherent conversation or project. It makes an attack less valuable.
Apple has done some research on blinding and obfuscating AI too.