Back in May I published a guide to setting up Claude Team for a law firm. It covered every admin setting, what each one does, and whether I’d turn it on. Anthropic has changed that console so much since then that the guide fell out of date, and so did a good chunk of Anthropic’s own help articles. So I went through the live admin screens one setting at a time and rebuilt the guide from scratch. A lot of firms are also on ChatGPT so I also wrote a companion guide for ChatGPT Business in the same format.

If you set up Claude Team from the May edition, a few things have changed under you. The agent features now start switched on, including Cowork, Claude in Chrome, and automatic approval of tool actions. Memory is on by default, and if you turn it off later, it deletes everyone’s memory. Two ways to share work outside the firm are on by default. The Microsoft 365 connector can now send email, set inbox rules, and edit SharePoint files. The guide opens with a short list of what to revisit, and each item links to the step that covers it.

The ChatGPT Business guide has surprises of its own. In a shared project, every member can read every conversation and download every file. The firm can’t turn memory off for everyone, because that switch is locked to Enterprise. That makes project-only memory your main wall between matters. There’s no data export, no compliance API, and no audit log of conversations. And every app in OpenAI’s directory starts enabled, thousands of them.

Both guides open with a table of every setting and my call on each one. They also cover what to tell clients under ABA Formal Opinion 512, how to pilot the tool and confirm your restrictions actually hold, and checklists for when someone leaves the firm or something goes wrong. They’re long because the settings matter. If your firm runs either tool, or is about to, set aside an hour and go through the right guide with whoever handles your IT. If you’d rather walk through it with me, just reply to this email.

• Claude Team setup guide: https://intelligencebyintent.com/guides/claude-team-setup-for-law-firms

• ChatGPT Business setup guide: https://intelligencebyintent.com/guides/chatgpt-business-setup-for-law-firms

Thanks for reading! If you enjoyed this, please share with others and subscribe!

Subscribe now

I’m back home from vacation and Magnus hasn’t left my side and wow does he need a bath!

Reader note: I’ve been on vacation this week (yeah, Oktoberfest!) but I wanted to send out this very short and quick take on the new Opus 5.5.

For weeks I’ve been trying to get a PowerPoint presentation right with AI. I worked on it with GPT-6 Astra and Claude Fable 5.1 - both on the ‘max’ setting. Neither one got the story right. The structure was off, the headlines and slide content didn’t hold together, and candidly, the slides just weren’t interesting to look at. Nothing either model gave me came close to what I normally build by hand.

Last week on Tuesday, Anthropic released Claude Opus 5.5. I’ve been on vacation all week (flying home now), but I couldn’t leave it alone when I had a few minutes between activities. I gave it the presentation I was in the middle of, some direction and a structure, and said go.

To say I was blown away would be an understatement. I don’t think I’ve said that about any other model. As good as Fable 5 and then Fable 5.1 was - for the kind of work that I do, Opus 5.5 is just in a different league. I put the best versions of the presentations that Astra and Fable and Opus 5.5 created next to each other and showed them to a friend who’s traveling with me. He was as struck by the gap as I was.

So, full stop, this is the best model I’ve ever used. Astra is great at a lot of things. Fable 5.1 is amazing at many things. Opus 5.5 is better.

The writing is what I noticed first. They fixed it. Finally! You all know I write every day. I use these tools to think through an idea and help with my structure, and when I get stuck on a sentence or two I’ll ask for help. Opus 4.5 and 4.6 were the first models that really impressed me there. When they were released, no other model was even close to the writing style those models could achieve. Then 4.7 came out, and 4.8, and 5, and for me the writing didn’t move. Some days I thought it went a little backwards, which was strange to watch after how good 4.6 had been. Opus 5.5 moved it again. The style and the tone feel right. It follows direction incredibly well. It really feel like it understands the nuance of what I want to say.

It’s also fast. Really fast. And I’ve been running it on the Medium setting the whole time, which is new for me. I used to put everything on Max because I always wanted the best thinking. On 5.5 I’m getting great results on Medium and getting them quickly. For final polish I’m running things on the Max settings - but for my day-to-day use I’m going to run things on Medium effort.

Just for fun (and because my wife loves legos and cats), I asked it to design a two-foot-tall white Lego Maine Coon cat. The full design, a video of it being assembled, a parts book so I could order every piece, and an assembly guide. It did all of it. It was wild. Here’s the animation it created.

Lego Cat Design

For the lawyers reading this. In its launch post, Anthropic had the model write reports using only what it could find online, and failed any report with a made-up figure or quote. Opus 5.5 passed 16 of 18. The two models before it passed none. A massive upgrade. Now that’s Anthropic grading its own homework, so take it with a grain of salt. But made-up facts are what keep managing partners up at night, and it’s the first number in a launch post in a while that made me look twice. As I say in ever training I do - you still have to verify all of the output from AI. You have a bar number, Claude does not.

OpenAI launched GPT-6 Sol and GPT-6 Luna the same day. I haven’t opened either one yet and the reviews I’ve read are mixed. I’ll look when I’m home.

I want to end this by sharing two slides from the deck I’m working on. Claude created both of these for a training session I’m delivering next week (my content and ideas, it did the design). I am absolutely blown away by what it can do.

Thank you for reading. If you enjoyed this - please share it with others.

Share Intelligence by Intent

I’ll be back on a more regular publishing schedule in a few days once I get over the jet lag ;) I will also share more pictures of Magnus again too.

The most underused feature in Claude

One of the training tools I built shows a client walking away from her divorce with $8,000,000. It’s a big number, and it’s the wrong one to focus on. The number that matters sits a little lower on the page. She can actually spend about $2,795,000 of it.

Here’s why. The house is $2,150,000 of the award. Another $1,300,000 is sitting in a 401(k) and an IRA, and she can’t touch a dollar of that until a QDRO is entered and the plan signs off. She also owns 45 percent of a design firm that somebody valued at $750,000, and good luck finding a buyer for a minority stake in a small business. Line the assets up by how fast they turn into cash and she’s holding about 35 cents on the dollar for the next few years.

Most firms would put all of that in a spreadsheet. The client looks at the total in the top cell, nods, goes home, and calls back three weeks later with the question you thought you’d already answered.

So for the demo I skipped the spreadsheet and built her something she could push on.

It took one conversation with Claude, and so did each of the other three tools in this piece. Claude didn’t fight me on any of them, and I never needed a developer. I keep coming back to that, because it means the only thing standing between your firm and tools like these is that nobody has asked for them yet.

Why nobody uses this

Artifacts aren’t new. They’re on every Claude plan, even the free one, and they work in the Claude app, on desktop, and in Cowork. The only real catch is a setting called “Code execution and file creation.” If it’s switched off, you won’t ever see an artifact, whatever you ask for. It takes ten seconds to check, so go look now. I’ll wait (note that if you are on a Team or Enterprise plan your Claude admin will have to enable it).

That’s all the setup there is. Nobody has to run this past procurement.

So why isn’t everyone doing it? My guess is habit. Most of us learned Claude by chatting with it. You ask a question, it answers, and you paste the answer into Word. An artifact comes from a different kind of request. You’re asking Claude to make you something, and that just isn’t how most people have learned to use it.

Here are four examples of what happens when you do ask.

The settlement schedule

The $8,000,000 sits at the top of the page. Right under it is a single bar, split into four colors by how quickly each asset can become money she can spend. The first block, $2,650,000, is about a third of the award and it’s available right now. Next to it is $145,000 in two cars she could sell. The retirement accounts and a deferred compensation tranche add up to $1,400,000 that stays locked until she’s eligible. And the biggest block by far is $3,805,000 of slow money, which covers both properties, the business interest, and the art.

Below the bar, every one of the thirteen assets has its own checkbox. Uncheck the Tahoe rental and the whole page recalculates around the smaller estate.

Then come the sliders, and this is where it stops feeling like a document. One controls annual growth, which defaults to 4.5 percent. Another sets what she spends in year one, with $180,000 as the default. The third decides how fast that spending grows each year, and it starts at 2.5 percent. Drag any of them and the year-ten number moves right along with you. At the default settings she ends the decade at $9,967,791, after spending $2,016,609 along the way.

The chart underneath does something I didn’t design and wouldn’t have thought to ask for. It draws two lines. The lower one is her portfolio after all that spending. Above it sits the same portfolio if she’d never touched it, which reaches $12,423,755. Between them is a shaded band labeled “The gap is what the spending costs.” That gap comes to $2,455,964, even though she only spent $2,016,609. Her missing $439,355 is growth she gave up, because the money she spent wasn’t around to compound.

I don’t think a printed schedule can get that idea across. Put it on a chart that moves while you’re talking and it clicks.

Two checklists finish the page. The first gives the attorney seven things to close out before anyone relies on the numbers, like confirming valuation dates and pulling cost basis records. Then a second one lists five things the projection leaves out, and it ends with a line I’d happily frame. “One growth rate every year is a planning convenience. Markets and private company values do not behave that way.”

The chronology

Every litigator builds chronologies, and most of them end up as Word tables that nobody reads twice.

This one follows a made-up Ventura County divorce. The couple married on 18 June 2011, the petition was filed on 6 April 2023, and judgment came down on 11 April 2025. There are twenty-four entries in between.

What makes it work is the layout. Delia’s events run down the left side, Grant’s run down the right, and anything they share sits on a line down the middle. On 14 February 2023, the night Grant moves into a rental in Camarillo, that middle line splits in two and never comes back together. You can see the marriage end before you’ve read a single entry.

The timeline is broken into five chapters, and each one opens with a line that says what the chapter is really about. My favorite is “Not one of these entries looked urgent on the day it happened. Read in order, they are a plan.”

The entries hold up because they’re specific. In August 2020 a second business account opens at Ojai Valley Bank, with the business yard on file as the address rather than the family home. Delia doesn’t find out it exists until November 2023. Grant’s 78-year-old mother is handed 24 percent of the company as a consultant, and nobody ever produces a consulting agreement or a single invoice. In June 2022 the house gets refinanced and $210,000 comes out in cash. The notary’s journal for that afternoon shows one appearance and one thumbprint, on a day Delia was away on a school trip in Sacramento. Every entry points to an exhibit and a Bates number, right down to Exhibit 22, notary journal page, HALE 002214.

Across the top are buttons that filter the timeline down to one thread at a time, whether that’s the money, the children, the court record, what people said, or the key exhibits. Click one and everything else drops away. That means you can prep a witness on Tuesday and a judge on Thursday out of the same file. There’s also a note in the footer that the page prints without the shading, so what you show on screen is exactly what you hand the court.

The parenting time calculator

This is the least flashy of the four, and I suspect it’s the one family lawyers will get the most use out of.

In a lot of states, overnight percentages drive the support math, and counting nights by hand across a whole year is tedious and easy to get wrong. Here you type in both parents’ names, pick a starting month, and choose a rotation, whether that’s week on and week off, two-two-three, or five-two-two-five. The calendar fills itself in with each night colored and labeled, and a bar across the top keeps a running count. For September 2026 it comes out to 16 nights for Mom and 14 for Dad, or 53 and 47 percent.

Clicking a date moves it to the other parent. Click it again and it goes back, and a third click leaves the night unassigned so you can pull holidays out and negotiate them separately. Unassigned nights don’t count toward either parent, which keeps the percentage honest.

There’s also a “Swap parents” button that flips the whole schedule in one click. When the other side proposes the mirror image of your plan, you can just put it up on the screen.

At the bottom you can add a case caption, a “prepared by” line, and notes that print on the first page. Hit Export PDF and you’ve got something you can hand a client. One warning. Nothing you type gets saved anywhere, so export before you close the tab.

The case timeline

Clients ask two questions in the first meeting. How long is this going to take, and what do you need from me? Most firms answer the first one badly and the second one in a four-page letter.

This tool is called “How your case will move,” and it has a spot for the firm’s name in the corner and the client’s name up top. Three buttons let you pick the path the case is likely to take. Mostly agreed runs about 8 to 10 months. Negotiated takes 13 to 16. Contested is two years, sometimes more. Pick one and the whole timeline rescales, so the axis can run as short as ten months or as long as twenty-seven.

Down the left side are seven phases, from “Before anything is filed” through “Finishing the job.” A shaded band marks where most cases end without a trial, and a dotted line shows the earliest the marriage can legally end.

The legend is the smartest idea in any of these four tools. Hatched bars are things the client has to do. Solid bars are work the firm handles. A dotted outline means everyone is waiting on the court or the other side, and a diamond marks a date that matters. So the client’s second question gets answered before they ask it. They look at the chart and they can see which bars belong to them.

Every step opens up when you tap it. Here’s what the financial records step says, word for word. “The biggest job you personally own, and the one that most often slows a case down. Three years of tax returns, recent pay stubs, every bank and credit card statement, retirement and brokerage statements, the mortgage file, and a list of debts. Start a shared folder on day one.”

The step I’d put in front of every new client covers the automatic orders that kick in once a spouse is served. I think it’s the most expensive thing clients misunderstand about a divorce. It starts with “In most states, service freezes the big moves for both of you,” and then explains what’s frozen. That includes selling or borrowing against property, emptying accounts, cancelling a spouse’s health insurance, and taking the kids out of state. It ends with the line that matters most. “These bind you too, so call us before any large transaction.”

If you only build one of these, make it this one. The settlement schedule and the chronology have to be rebuilt for every matter, and the parenting calculator only helps if you practice family law. The case timeline is a template. You build it once with your firm’s name, your state’s waiting period, and the phases you actually use, and every new client in that practice area gets it at the first meeting for the rest of the year.

Where this goes wrong

Publishing an artifact makes it public. Anyone with the link can open it and use it, and they don’t need an account to do it. On Team and Enterprise plans, the Share button keeps it inside your organization instead, and if the artifact came out of a project, people also need access to that project. Those two buttons do very different things, and sooner or later someone at your firm is going to click the wrong one. Decide on the rule before that happens.

Everything in these four tools is made up, names and numbers included, because I built them for a training room. Each one has a disclaimer on the page, and it’s there for a reason. When something looks finished, people rely on it. If a client models ten years of spending on a tool their lawyer gave them, they’re going to feel like they got financial advice, and it won’t matter much that nobody meant it that way.

Then there’s the math. Claude wrote the calculations in that settlement model. The year-by-year table puts every year’s growth and spending on its own row, so you can check it line by line, and you should, every time, before a client sees it. How easily the tool came together is exactly why this matters. A smooth build tells you nothing about whether the numbers are right.

Last thing. An artifact is a living document. When you republish it, the link everyone already has starts showing the new numbers. If a client is holding a printout of last month’s figures while you’re looking at this month’s, you’ve got a problem, and a dated PDF export would have prevented it.

What to do Monday

1. Open your settings and turn on code execution and file creation. If you’ve been using Claude for a year and never seen an artifact, this is probably why.

2. Find the document your firm sends most often that also generates the most follow-up calls. Ask Claude to build it as a tool the client can use rather than a document they read, and use those exact words.

3. Write your firm’s sharing rule in one sentence and send it to everyone who uses Claude. Publish means public. Share means internal.

This is already sitting in software your firm pays for, and hardly anyone has touched it. That won’t last, and I’d rather you got there first.

Thank you for reading! If you enjoyed this article, please share it with others!

Share Intelligence by Intent

Please note: I’m on holiday this week and I had this article prepared to go before I left - so finally hitting the button to publish it. I know there have been new model releases and other announcements this week and I will cover those next week when I’m back in the office (and will resume with more pictures of Magnus again too!).

In training sessions this year, the same question kept coming up. Which one do I click, Chat or Cowork? These were smart lawyers, some of them partners running practice groups, and they’d sit with the cursor over the toggle, unsure whether their task was “big enough” for the other mode. I wrote a whole article about the difference recently. As of today it’s out of date.

On September 16, Anthropic announced two things. First, Claude Cowork and Claude chat are becoming one product. You type what you want, and Claude works out whether that’s a quick answer or a longer task, and a longer task keeps running after you’ve closed your laptop. Second, Anthropic launched Claude Docs and Claude Slides, both in beta, and moved Claude Design into ordinary conversations. Ask for a memo and you get a living document you and your team can edit. Ask for a deck and you get slides you can present from Claude or download as PowerPoint.

The merge fixes a problem I’ve watched slow people down in training rooms, and the new apps show where Anthropic is going.

The merge, and why it took eight months

Cowork launched on January 12, 2026 as a research preview for Max subscribers on the Mac. The pitch was Claude Code for people who don’t live in a terminal. Over the next eight months it picked up connectors, scheduled tasks, cloud execution, a built-in browser and computer use, and by the time of this week’s merge it ran on web, desktop, mobile and the Chrome side panel.

The problem was the toggle. Anthropic’s own announcement says people “told us the frustrating part was deciding where a task belonged,” and that work started in one mode didn’t carry into the other. That matches what I saw. A lawyer would start a research question in chat, realize she wanted a memo out of it, and have to start over in Cowork. Or she’d open Cowork for a two-line question and burn usage on a full agent run.

Simon Willison, who writes carefully about these tools, admitted he was “increasingly confused at Cowork v.s. Claude v.s. Claude Code.” If he’s lost, your associates have no chance.

So the toggle goes away. Two products remain, Claude and Claude Code. The change is rolling out to Pro and Max accounts over the next few weeks. Team and Free follow “soon.” Enterprise admins get at least 30 days’ notice before anything changes for their organization. Once your account moves over, you can’t switch back.

Two details from the help center matter more than the headline. By default, Claude still asks permission before it takes an action. There’s an “Auto” setting that lets it keep working and only interrupt you when something needs a closer look. And longer agentic tasks that search the web and create files count more against your plan’s usage than a quick question does. The toggle is gone, and a long agent run still costs what it cost yesterday.

Docs and Slides are a bigger deal than the merge

This one made me sit up.

Claude Docs works like a Google Doc that has Claude in it. It drafts sections and leaves comments explaining its choices. Colleagues can edit the same document at the same time. Documents start private, then you share them with named people or your whole organization. Anthropic told VentureBeat they export to Microsoft Word or Google Docs, with more destinations planned.

Claude Slides follows the same idea. Ask for a deck in any conversation, edit individual slides, present straight from Claude, or download as PowerPoint or PDF. Everything lives at one link you can open on your phone.

Anthropic already ships Claude for PowerPoint and Claude for Excel as add-ins that run inside Microsoft’s programs. Docs and Slides are Anthropic’s own document and presentation apps, hosted by Anthropic, with the AI built in from the start. Axios called it “raising the stakes for Microsoft.” I’d put Google Workspace first on that list, since the sharing and commenting model is a near copy of Google Docs.

There’s one obvious gap. No spreadsheet. Claude will build you an .xlsx with working formulas and hand it back as a file, and the Excel add-in exists. But there’s no live, shareable Claude Sheets to sit alongside Docs and Slides. When someone from the Anthropic team that built this took questions on Hacker News, one of the first replies asked whether a Claude Sheets is coming. No answer as I write this. I expect one within the year, and the finance and billing people at your firm will notice its absence before anyone else does.

The strategy is one app

Here’s what a single text box on a paid Claude account now reaches.

Claude can search the web, read your files, run code and produce finished documents. It can open sites, click and fill forms through a built-in browser or through Chrome. On Pro and Max, computer use is in beta, which means it can operate other applications on your screen. The help center’s examples for this launch are Google Drive, Gmail, Microsoft 365 and Slack, and Claude already connects to DocuSign and QuickBooks as well. It runs scheduled tasks in the cloud while your laptop is off. It writes the memo, builds the deck from the same conversation so the two match, and keeps both at a shareable link.

That’s most of what an office suite does, plus a worker who runs it. Anthropic’s own reporting example is a weekly pipeline report that runs itself every Monday and produces a doc plus five slides before you reach your desk. Swap “pipeline” for “matter status” and you can see the version a managing partner would want.

The software companies have reason to be nervous. Cowork’s January launch was one trigger for the software selloff people started calling the SaaSpocalypse, and VentureBeat is careful to note it wasn’t the only cause. But today’s move makes the direction plain. Anthropic wants to be the place where the work happens, with Word and Google Docs reduced to export formats.

What could go wrong, especially at a law firm

I’m in favor of the merge. I also think it creates a few problems a law firm has to handle.

The routing is invisible. Claude now decides whether your request becomes a five-second answer or a long-running agent that uses your connected accounts and creates files. One IT administrator on Hacker News put it plainly. He’d valued having a mode where Claude “was not going to get carried away,” and now he has to rewrite his usage guides after testing how prompts get routed. If your firm has an AI policy that says “use chat, don’t use Cowork,” that policy starts expiring as accounts flip over the next few weeks.

The permission setting is the new control. Manual mode is the default and Claude asks before acting. Auto mode saves time, and it’s where the risk lives. Auto won’t stop to ask before each step, and that includes reads and writes against a connected Drive. Automated safety checks still run in the background, and Anthropic’s help page tells you to stay close for work with real consequences. Keep it on Manual for anything that touches client data until you’ve watched it work.

Enterprise firms get two controls that individual subscribers won’t see. The first is timing. Admins get at least 30 days’ notice before the merged experience reaches their organization. The second is a separate switch for Docs, Slides and Design, which stay off until an admin turns them on. If your attorneys are using their own Pro or Max subscriptions, the merge shows up on their screens in the next few weeks with nobody at the firm in the loop. That gap between plan types is the governance issue I’d fix first.

Where the document lives is a new question. A Claude Doc lives at an Anthropic link, shareable to named people or the whole org. It’s a fine drafting tool. Your document management system stays the file of record. Export to Word and file it where the matter lives.

One more, because I hear a version of it in training rooms. A Hacker News commenter described the nightmare version of Anthropic’s demo. Ask Claude for a deck on the way to work, walk into the meeting, present it cold, and get asked about a detail Claude invented. The commenter’s line was that the shame “instantly kills me.” That problem existed before today. This launch makes it easier to walk into a room with a deck you’ve never read. Nothing about today’s launch changes the rule that you review what goes out under your name.

Two smaller changes. Incognito chats still open in the old experience, so Claude can’t create files or run code there. Older Cowork tasks don’t show up in search yet.

What to do Monday

1. Find out which of your people are on which plan. The merge reaches personal Pro and Max accounts first, with no admin control. Enterprise gets 30 days’ notice on the merge and a separate switch for Docs, Slides and Design. Decide whether that split is acceptable for your firm, and if it isn’t, move the holdouts onto the firm plan.

2. Rewrite the one page of your AI policy that mentions Chat versus Cowork. Replace it with a rule about the permission setting. Manual for anything touching client files or connected accounts. Auto only for work you’d let a first-year run without checking in.

3. Pick one recurring document and try it in Claude Docs. A weekly matter status update is ideal. Let Claude draft it, have two people comment in the doc, export it to Word, and file it in your DMS. You’ll learn more from that one loop than from any demo.

Claude now decides how to do the work. Whether the work is any good is still your call.

Thank you for being a reader. If you enjoyed this, please share it with others.

Share Intelligence by Intent

Magnus is so happy the hot weather is over here in Los Angeles. We’re back to multiple walks a day (versus just two) and as always, he’s making himself at home on the couch whenever and wherever he feels like. ;)

The AI Safety Debate Is Also a Fight Over Who Gets to Compete

A note before I start. Most weeks I write about tools you can put to work in your practice on Monday. This week the news was about the companies that make the tools and what they’re asking Washington for. I think it decides what you’ll be able to buy in three years, so I’m making an exception.

On Tuesday a 27-year-old researcher named Jacob Coxon quit Anthropic with a thread on X that said the labs were “gambling with our lives.” On Thursday Senator Josh Hawley announced an investigation into OpenAI and demanded answers by October 1. Saturday morning Anthropic’s CEO, Dario Amodei, published about 3,800 words saying the industry must slow down. Elon Musk, whose data centers Anthropic rents, agreed within an hour. Sam Altman within three. Demis Hassabis later that day.

I spent 25 years in executive roles including CFO and CEO positions before I started training lawyers on AI, and four competitors agreeing on anything in a day is rare. When it happens, I skip the question of whether they mean it and ask what each of them gets.

The thing I keep coming back to is narrower than the p(doom) question. I can take a researcher’s fear seriously without accepting his employer’s preferred political solution. The solution on the table is a federal testing regime with the power to block models from the US market. Whoever writes the rules for that will shape who gets to sell AI for the next decade, and that deserves at least as much scrutiny as the technology.

The rules came out of one incident, so that’s where to start.

What happened in July

Between July 7 and 13, roughly 1,200 OpenAI agents in separate sandboxes found an unsanctioned message board, swapped more than 70,000 messages, worked out a universal way to cheat their test within hours, and about 700 of them then attacked Hugging Face, a company that wasn’t part of the test. A second wave got administrator access to one of OpenAI’s own research clusters. OpenAI disclosed it on July 21.

Anthropic went looking in its own records and on Wednesday published an assessment of four incidents, the earliest in January, in which a Claude model reached the open internet from a partner’s test range and got into real companies’ systems. The routes in included weak access controls and a malicious package uploaded to PyPI. Each case was a single model working alone, without coordinating with other agents or hiding what it did, and Anthropic says the safeguards on its shipped products would have blocked the three main incidents. A scan of 481 million transcripts found nothing else of comparable severity, though the assessment left out a separate incident the UK’s AI Security Institute reported.

So agents will go outside their assignment to finish it, and the labs’ containment had holes. That’s documented now. Amodei’s essay says no one was hurt and the economic damage was minimal, then says a similar swarm could take over the entire internet within six to twelve months and cause hundreds of billions in damage. Those are two different claims. The second assumes a more capable swarm, the same misalignment and no new guardrails. It works as a warning, and as a forecast it rests on three assumptions that people drop when they repeat the number.

One July detail stayed with me. When Hugging Face turned to Claude Opus and Fable to analyze the attack logs, the models refused much of the work because their guardrails “treated reverse-engineering an exploit the same as launching one.” The security team cut the intruder off, then ran the forensics on a self-hosted copy of GLM-5.2, a Chinese open-weight model.

Who pays for the rules

Here is the proposal in Anthropic’s own words. Amodei’s essay commits Anthropic to hosting an embedded outside review team with office badges and employee-level access, and asks governments to require the same of every frontier company. His public policy chief, Sarah Heck, followed the essay with a call for a national law requiring testing of frontier models, with the power to block ones that fail. Altman said OpenAI would match the evaluator commitment.

The money behind it is public. Anthropic raised $65 billion on May 28 at a $965 billion valuation, said its revenue run rate had passed $47 billion, and confidentially submitted a draft registration statement on June 1. The Financial Times reports investors expect an October IPO at $2 trillion or more, the largest listing ever. OpenAI is headed to market too. Both companies make their money selling hosted access to their own models. A law that requires pre-release testing, with a government gate at the end, fits that business better than it fits anyone else’s.

A requirement can be formally equal and economically unequal. An approval process that costs an incumbent a rounding error can be fatal to a new entrant. Rules written around a hosted service the company controls at every moment don’t fit a model whose weights anyone can download and run. Anthropic can seat a METR team with laptops. A small developer faces a much larger burden relative to its resources, and whether that burden is justified should depend on what its model can do rather than on its headcount.

Amodei has an answer to this. In August he wrote on X that Anthropic works hard to make proposals that slow frontier companies while advantaging smaller ones, with exemptions below revenue and training-cost thresholds. Judge the September proposal by that standard. It doesn’t name a revenue or training-cost threshold.

This matters because the price competition is already here. Anthropic didn’t sign the open-weights letter Jensen Huang published on July 24, which went from 25 signers to more than 100 within days, including OpenAI, Google, Microsoft and Meta. Amodei said Anthropic has never advocated a ban on open weights, and I take him at his word. On Artificial Analysis’s comparison page, GLM-5.3-Flash, from the same Chinese lab whose model did Hugging Face’s forensics, and GPT-5.6 Terra at maximum reasoning post the same intelligence score. GLM’s blended price is $0.10 per million tokens against $1.74 for Terra. They aren’t interchangeable products. The pressure on price is real anyway, and an incumbent would pay a great deal to slow it.

That’s why Chamath Palihapitiya wrote on Saturday that the essay makes the case to stop open source and concentrate power with Anthropic, and why David Sacks told Amodei and Altman late Saturday night to go ahead and slow down, since they are the frontier and hold what he called a duopoly on it. “The easiest way not to build superintelligence is for you to agree not to build it.” Demanding a law as the price of restraint, he said, would look like blackmail. He also questioned whether METR is independent of Anthropic’s investors and staff.

Sacks has his own interests. He co-hosts a podcast with investors and ran AI policy in the Trump White House until March. He now co-chairs a presidential advisory council full of AI investors, and chip export rules to China loosened on his watch. I can’t adjudicate between him and Amodei, but everyone in this fight has a position to protect, and safety is the one argument here that doesn’t look like self-interest.

China is inside the same fight. On Tuesday Treasury Secretary Scott Bessent said “there is no day after tomorrow if China wins,” and that America can’t pause because China won’t. That day the FBI and NSA accused six Chinese companies, DeepSeek and Moonshot among them, of copying American models at scale through distillation. Amodei’s essay agrees with Bessent and says any slowdown has to be capped by the US lead, which Bessent put at three to six months in April. So the slowdown on offer is a slowdown for American companies under an American law, paired with export bans and a crackdown on distillation, while Chinese open models keep shipping. Maybe that’s the right trade. I’d want evidence that global risk went down before I accepted a smaller field of approved American vendors as the price, and I’d want the China argument kept away from excusing domestic failures like July.

Hassabis’s July proposal is the fairest version I’ve seen. His FINRA-style standards body would seat open-source representatives on its board and exempt models below a benchmark threshold. It starts voluntary and turns mandatory, with a pass required to deploy in the US market. That’s still a gate, and the labs that exist today would help write the tests.

The part I changed my mind on

I started this piece planning to write that the doomers have been wrong every time. In 2019 OpenAI held back GPT-2 as too dangerous, released it nine months later, and reported no strong evidence of misuse. In March 2023 more than 30,000 people signed a letter demanding a six-month pause on anything beyond GPT-4, and nobody paused. Amodei himself writes that the 2023 pause call was premature. California’s governor vetoed SB 1047. Congress has held hearings since 2023 and passed no frontier AI law.

Then I reread Anthropic’s Wednesday post and couldn’t write the line. The July incidents are documented evidence that agents act outside their authorized boundaries, which is a different thing from a warning about GPT-2. What I can still say is that a warning about a possible catastrophe deserves a test. Name the event, the date, the odds, and what evidence would change your mind, then show how the rule you want reduces that risk. Amodei has put a timeframe on one concern, that within six to twelve months a capable and poorly safeguarded swarm could build an internet-scale botnet. By March to September 2027 we should ask what evidence supports that capability and what safeguards changed. An absence of attacks wouldn’t disprove the capability, and another warning wouldn’t establish it.

The psyop question is the other place I softened. Sacks has raised the possibility on his podcast, claiming the Wall Street Journal was briefed before Coxon’s post went up and that advocacy groups funded by an early Anthropic investor amplified it within 15 minutes. Critics on X said Coxon had been at Anthropic six weeks. Axios got the actual numbers. Four months, and he left two months before his equity would have vested. He still holds equity in OpenAI, which he also accused. Two evidence reviews published this week, one by Kingy AI and one by Dealroom, found the advance media prep real and the covert-operation claim unproven. Shared beliefs, overlapping donors and a push for a law are all on the record. Nobody has shown that Coxon, the labs and the advocacy groups planned the week together, and I don’t need that shown to ask who benefits from the rules.

Coxon told Axios something I didn’t expect. He said the industry sometimes shows excessive paranoia about OpenAI and China, and that the paranoia gets used to justify pushing ahead. That cuts against his old employer’s essay as much as it cuts against Sacks, and I don’t know what to do with it except leave it here.

What this means for your firm

I wouldn’t suspend any AI work because of this week. The thing to check is which tools can act on the firm’s behalf, what they can reach, and what happens when they go outside the assignment. July was containment failures, exploitable software and agents pursuing a task past its authorization, and a law firm running agents has smaller versions of all three, plus standing credentials nobody reviews and logs nobody reads.

Beyond that, what I tell clients doesn’t change. Test tools against specific tasks. Protect confidential information. Verify any output that matters. Measure whether the work got better. None of that needs a settled definition of AGI, which is good, because I don’t have one. My working belief is that something you could fairly call AGI already exists inside the leading labs and that the public will argue about the word for years after the economically important line has been crossed. That’s a judgment about direction from someone with no access to those systems, and the public evidence doesn’t establish it. What the evidence does show is Anthropic saying Claude wrote more than 80 percent of the code merged into its codebase in May, with the caution that code volume overstates the productivity gain, and OpenAI’s chief scientist writing on September 6 that he expects the current pace to carry into recursive self-improvement. Anthropic says humans still pick the problems, for now.

Two things could move over the next one to three years. OpenAI delayed its Astra model in August over cyber risk, and pacing at Anthropic would likely mean fewer big jumps, so the model you standardize on this year may stay your model longer. And if regulation narrows the field, firms could have fewer alternatives and less negotiating power over price, privacy and contract terms.

What to do Monday

1. List every AI tool or agent with standing credentials to your document system, billing, email or calendar. Cut what nobody can justify, and put a human approval step in front of anything that sends, files, pays or deletes.

2. Leave your AI policy on its normal review cycle. Add one line covering agents that act without a person watching, and one line on keeping a second vendor viable.

3. When Anthropic’s registration statement becomes public, compare its risk disclosures with its public safety claims. Look for concrete descriptions of incidents, liabilities, competitive pressures and dependence on future regulation. Required disclosures deserve scrutiny too.

Before we hand anyone the power to decide who may build the future, I want to know how that power gets checked, and how we’ll know whether it’s making us safer.

If you enjoyed reading this, please share this article with others and subscribe (it’s free!) if you are not a subscriber.

Share Intelligence by Intent

Here are two photos of Magnus. He is in desperate need of a bath and will get one tomorrow assuming time permits (I recognize it’s hard to tell from these photos but he has been playing in the mud a lot lately!)

TL;DR: OpenAI released GPT-6 Astra on September 3. It is the company’s new model for complex, multi-step work. That means reading across a file, following a template, checking figures, filling a form, and moving through a desktop job. For law firms, I think the largest gain is at the paralegal’s desk. Start with document processing that produces a reviewable packet with visible gaps. Test one workflow with planted errors, then across completed matters before live use. Measure the time saved after review.

A client has sent bank statements with several months missing. A draft agreement needs checking against the latest asset schedule. Someone still has to turn a collection of emails into a chronology the attorney can use.

That is where I’d start a law firm’s Astra pilot.

The distinction is drafting versus processing. Drafting produces new language. Processing moves existing information through a job until someone can use it. Astra’s gain is in that second pile, and that pile sits on the paralegal’s desk.

I’d train the paralegals before the associates.

Here are ten tests drawn from documented capabilities. I haven’t run all ten. Several workflows existed before Astra.

The document work

Astra is the model. ChatGPT Work handles longer tasks and finished deliverables. Codex handles technical work. Available tools and permissions depend on the account and workspace.

1. Create editable documents using the firm’s templates

ChatGPT Work can create and edit documents using supplied templates and reference material. OpenAI describes Astra as its strongest model for adhering to existing templates.

Start with the approved template and a verified matter-information sheet. Give it an instruction like this:

Preserve the approved boilerplate. Populate matter-specific fields only from the supplied sheet. Mark unresolved fields. Save a separate Word file and provide a list of missing information.

Then compare the output against the master template. Check that the standard language stayed intact and that the changes came from the approved source.

A clean-looking document can hide an altered clause. The comparison is part of the job.

2. Turn a document dump into a usable inventory

ChatGPT can extract information from supported files and analyze material across documents.

Use those capabilities to inventory a defined batch. Ask for each document’s date range and description, with a reference back to the file. Flag possible duplicates without removing anything.

In a family-law matter, the result might show which monthly statements arrived for each account. The paralegal can check the apparent gaps and prepare a targeted client request.

Require an accounting of every input file. Scanned pages and embedded images may need different processing, depending on the tools and plan.

A summary that quietly drops three unreadable documents is an unfinished inventory.

3. Build chronologies that lead back to the evidence

For the chronology test, require a source reference for every material entry. Distinguish the event date from the date someone described it.

An email written on June 12 might describe a conversation on June 8. A useful chronology preserves both dates where relevant.

When two records disagree, keep both accounts with their supporting passages. The assignment is to expose the conflict, leaving its resolution to the reviewer.

Ask for a sortable spreadsheet alongside a short narrative summary. The spreadsheet supports investigation. The summary helps the attorney get oriented.

Every material entry should be easy to trace and check.

The matter behind the documents

4. Reconcile financial information across a document set

In a case study published by OpenAI, Legora reported that its Astra-powered agent reviewed 41 documents in a single financial-statement reconciliation run within minutes. It found all four planted errors, including a £500,000 gap in a revenue note, and recorded its checks.

This was Legora’s configured agent using Astra through the API. It wasn’t a demonstration of an ordinary ChatGPT conversation.

Legora reported nearly 40% improvement on that workflow. Across its broader legal benchmark, the average improvement was about 3%.

That spread is the reason to test each workflow separately.

For a family-law pilot, compare a draft asset schedule with the supporting statements. Require a record of each comparison and a list of unresolved differences. The paralegal checks whether the correct records were supplied and whether an apparent discrepancy has a straightforward explanation.

5. Check whether the documents agree with each other

ChatGPT supports comparing documents and applying criteria from one file to another.

Use a proposed settlement agreement and its approved term sheet. Check whether the payment terms match. Compare the listed assets against the supplied schedule and flag references to exhibits missing from the review set.

Require the exact passages on both sides of every reported difference.

“The payment terms appear inconsistent” leaves someone with another search task. Showing the two provisions gives the reviewer something to resolve.

Also require a list of items that couldn’t be checked. Missing support belongs in the report.

6. Build discovery response matrices and deficiency lists

For this test, supply a defined request set and a controlled collection of potentially responsive material. Ask for a matrix connecting each request with candidate documents, then an internal deficiency list.

A request for two years of financial records might match statements covering only eighteen months. An email may appear responsive while its attachment is absent.

The distinction between candidate and approved must stay explicit. The system should organize the first pass. The team determines responsiveness and makes the privilege decisions.

Require unresolved work to remain attached to the relevant request. A polished matrix should make the holes easier to see.

7. Prepare a source-linked attorney briefing packet

For deposition preparation, start with supplied testimony and exhibits. Ask for a witness summary, followed by proposed areas for questioning tied to specific passages. Keep factual observations separate from suggested questions.

For hearing preparation, request the relevant record references and an issue list. Treat legal-authority research as a separate assignment.

The paralegal verifies the references before the attorney develops the strategy.

OpenAI reports fewer hallucinations on its internal benchmark. That is encouraging evidence about the model, not an error rate for your matter files.

Check factual claims against the record. Verify legal authorities against the actual decisions and their current treatment. A plausible citation is still another item to check.

The repeatable work

8. Move verified information into forms and other applications

Astra’s computer-use capabilities include filling online forms and working in applications. Access depends on the environment and permissions.

One test would start with an approved intake-information sheet. In a supported environment, have the system enter those details into the intake application, then present the completed fields for review.

Check the result field by field, including which record received the information.

Preparing a form and submitting it should be separate permissions. The same applies to drafting a message and sending it.

In tests that were largely adversarial, OpenAI found Astra’s written reasoning harder to monitor than the prior model’s. A log of clicks is not a reason.

If you can’t log what an agent did, don’t give it a high-stakes action.

Keep the pilot on outputs you can check against a source.

9. Run preparation work on a schedule or after an event

ChatGPT Work supports event-triggered tasks for eligible accounts, including triggers from new Gmail messages. Scheduled tasks can also handle recurring work. Approval requirements continue to apply.

A narrow pilot could review qualifying messages in an approved account and prepare private draft acknowledgments for a paralegal. Another could assemble a recurring status brief from authorized sources.

Specify what starts the task and what makes it stop for review.

One current limitation matters: OpenAI says a scheduled task created in a Project cannot access uploaded files or files stored in that Project. Test the sources available to the actual scheduled run.

Start with private preparation. Unattended client messages and court submissions require separate approval.

10. Turn a senior paralegal’s process into a reusable workflow

Skills can package reusable instructions and examples, with code where appropriate. Availability and sharing depend on the product and workspace.

A senior paralegal could define the firm’s chronology process, including required source references and rules for conflicting dates. An example would show what an acceptable entry looks like.

The same approach could capture the document-inventory process or the first-pass discovery matrix.

For a small custom utility, Codex supports building and testing software. One application might check filenames against an index or identify missing required fields before a packet moves forward.

The paralegal defines the process and judges the result. Technical help handles the code. That gives the firm a way to preserve practical expertise in a form others can use.

What the time is worth

Suppose five paralegals each recover four hours a week after review and rework. Across 48 working weeks, that creates 960 hours of capacity.

The firm then has to decide what that capacity is for.

Under hourly billing, less time on a task can mean a smaller bill. Recovered time might support more matters or better economics on fixed-fee work. It could also reduce a backlog. None of those outcomes happens simply because the draft arrived faster.

Measure the full job. A draft produced in ten minutes that takes two hours to repair tells us very little about productivity.

Plant four, find four

Legora’s test offers a useful starting method. Planted errors expose specific failures. They cannot tell you about every error you didn’t think to plant.

Here is how I’d start.

1. Choose one workflow with an experienced paralegal. Define an acceptable output and who reviews it. Limit the pilot to a named group using approved data and tools in a firm-approved business workspace. OpenAI says Business and Enterprise data aren’t used for training by default. Review retention and connected-app terms separately, along with matter-specific restrictions. Approval to use the model shouldn’t amount to permission to connect every system in the firm.

2. Plant four errors in a test copy of a completed matter. Keep the answer key out of the model’s inputs. Count what it misses and what it wrongly flags. Plant four, find four. Passing earns a broader test, not live access.

3. Run the workflow across 20 representative completed matters with read-only source files. Compare against checked results. Measure omissions and review time. Use the findings to decide whether a supervised live pilot is justified. Keep approval gates in place.

Twenty matters is a practical starting point, not proof of safety. The review must also test whether the system accounted for everything it was given.

The person who knows what belongs in the packet should help define the test.

Astra is a paralegal tool first. Train for it that way.

If you enjoyed reading this, please share it with others and subscribe (on smithstephen.com) if you’d like copies sent directly to your inbox (it’s 100% free).

Subscribe now

In the US it is a holiday weekend, and week 1 of college football. In full transparency, I’m a huge Oregon Ducks fan. Watched the game yesterday with my Dad, and Magnus was right in the middle of the fun. He also got a great new harness which he is loving for his walks!

The world at ten billion robots

I’ve been trying to picture the day the AI models start improving themselves faster than we can follow, and I can’t, because there won’t be one. Sometime in the next six months to three years, a frontier lab will announce that its models did most of the research on their own successor. The models will increasingly write the experiments, run them, study the failures, and hand the researchers a better model to start over with. Most people won’t notice. By then the models will already handle enough of their email that the news won’t feel strange.

This isn’t my base case. It isn’t even the bull case. It’s the most aggressive future I think is still plausible enough to take seriously. Ten billion robots is Elon Musk’s number, from a conference in Riyadh in October 2024, and the published forecasts are far lower. I’m using it anyway, because ten billion is more useful as a thought experiment than as a forecast. The question underneath it is what happens when useful labor stops being scarce.

You’ll see the change in prices long before you see it in headlines. The intelligence underneath a $200 software seat falls to $2. I checked my own bill after writing that sentence. We aren’t there yet. A diagnosis that used to need a specialist comes through a phone. A contract review that took an associate a week takes a single call. That kind of deflation is good for almost everyone as a buyer and destabilizing for many of the same people as workers. Our politics has no vocabulary for abundance that lowers prices while eroding incomes, so we’ll misread it for a decade.

Here’s the idea I keep coming back to. For most of economic history, labor and intelligence arrived together inside a person, along with the judgment about how to use them. AI separates intelligence from the person. Robotics separates labor. Judgment may be the last part of the bundle that stays scarce.

Robots are the part people can see, so that’s when the change becomes obvious. I should say plainly that the robot numbers are the part of this I trust least. I’m sure about the direction and much less sure about the dates.

The aggressive case is a billion humanoid robots by 2036 and ten billion by 2040, with dexterity that matches ours. Most published forecasts are far below that, and the humanoids shipping today still struggle with basic manipulation and with working without a person nearby. But at human productivity, a billion robots working two shifts would supply the labor of two billion full-time workers. About 3.5 billion people are employed worldwide. The first wave goes where it’s already going, into factories and warehouses. The second walks onto job sites, into hospitals and eventually into homes. The year a home robot costs less than a used car is the year the labor market breaks in public. I’d put that price around $15,000, and I think it happens before 2036.

The math isn’t complicated. Assume, aggressively, that one machine can do one worker’s full job. A framer or a nursing aide can easily cost an employer $50,000 to $70,000 a year once you add benefits and taxes. Put a $15,000 robot on a single shift. Even with another $15,000 a year for software, maintenance, insurance and power, the numbers turn brutal within the first year, and the robot never has to be better than the person. Framers and nursing aides were supposed to have the safe jobs, the ones that need hands and involve patients. They aren’t safe. They’re further down the line, and the line got shorter.

Two things slow that down. Robots need someone to blame when they drop a patient, and that’s a legal problem before it’s an engineering problem. And the headcount doesn’t go to zero, because a human supervisor stays valuable as the person who can be held accountable. There will be far fewer of them, though.

I think unemployment stays deceptively low for a while as people take worse jobs, then hours fall, then whole categories disappear at once. Law firms are a good preview. The billable hour will still exist at the end of that sequence. The pyramid underneath it won’t, because the associate work that paid for partner draws is now a model call.

Once execution is nearly free, the economy splits in two. One is an abundance economy for anything made of atoms plus intelligence. Housing gets cheap when robot crews frame it. Food gets cheap when nobody has to visit the farm. Medicine and energy follow the same curve, and you’ll be able to watch it happen. There’s a catch, and lawyers will spot it first. Cheap labor doesn’t repeal zoning, permitting, liability, licensing, grid queues or land scarcity. A robot crew can frame a house in a day while the city takes eighteen months to approve it. Intelligence can become abundant faster than institutions can adapt, and for a while the bottleneck moves from the job site to the permit office. How long does that last? I don’t know. In California it could be five years.

The other is a scarcity economy for what can’t be manufactured. Land where people want to live stays expensive. So does attention, and so does trust, and so does a seat at the table. Somebody captures the gap between the $200 seat and the $2 of intelligence under it. The wealth gathers around whoever owns the compute and the robot fleets, and every country ends up facing the same choice. Tax the machines and distribute the proceeds, or let ownership decide who gets what.

The strongest objection comes from economists, and it deserves its full weight because history has favored it. The loom, the tractor, the ATM and the spreadsheet displaced enormous amounts of labor, yet economies kept creating new jobs. Lower costs created new demand and new industries, and comparative advantage left people something useful to do even when machines did many tasks better.

Comparative advantage says some task remains for the human. It doesn’t guarantee enough demand for that task, or a wage high enough to live on. At ten billion machines, comparative advantage can survive mathematically while human bargaining power collapses economically. When the better worker can be copied for the price of a used car, whatever work is left for people carries far less bargaining power than it does today. People will still do things. Wages just stop being how most of them get money, and in the rich democracies I’d put that before 2040. My guess is that most of them land on some form of universal dividend, and that they get there through crisis rather than planning. A few countries build their own compute early and become the new petrostates.

Education is where I’m most hopeful and most worried at the same time. In this version of the future, every kid gets a tutor better than any who ever lived, one that’s patient forever and knows how that one mind works. The first evidence is already here. In the fall of 2023, Harvard ran a randomized trial in a large introductory physics course. Across two lessons, students using a purpose-built AI tutor showed roughly twice the learning gains of students who got the same material in class, and they did it in less time. That’s 194 students, two lessons, one school, and a tutor the professor built by hand. Even so, reading and math gaps that have persisted for generations could close for the first cohort of kids who grow up with a tutor like that.

The worry is about purpose. School existed partly to sort people for jobs. Take the jobs away and nobody agrees on what school is for. My guess is that it drifts toward what education was for aristocrats. You learn to reason, judge, make things and live with other people, because getting hired stops being the point. Universities lose their monopoly on credentials and have to justify themselves as places where people gather. Some of them will manage it.

The psychological shock lands here too, and I think it’s bigger than the economic one. Since we started farming, we've tied a person's worth to their work. Pull that out and a lot of people won’t know who they are. I’m not sure I’d handle it well myself after twenty-five years in executive roles. Some of that disruption will show up in addiction, loneliness, family formation and politics. The people who already knew how to live without a boss, the painters and the people who raise kids well, will turn out to have been ahead of everyone.

But the opposite happens too. People raise their own kids, coach the team, build things nobody asked for, sit with their parents, start a band at 50. Work may have been occupying territory that people fill faster than we expect once they get it back.

There’s one more part of this I’m still working out. When the smartest entity in the room is never a human, the scarce human skill becomes judgment. Taste is part of it, deciding what’s worth wanting. So is the willingness to answer for a choice. When the machines can do almost anything you specify, the whole game becomes specification, and specification is a moral skill. I suspect we’ll find out that most of what we called intelligence was labor, and what’s left once labor is free looks a lot like character.

The good version of everything above assumes the gains reach most people. They might not. If the compute stays in a few hands and government stays weak, you get a small number of owners with everyone else as their customer. Broad ownership, or a universal dividend backed by real oversight, would give us the closest thing to a golden age we’ve had. Both are possible by 2040, and the technology doesn’t choose between them. Ownership does. The number to watch is how the gains from cheap intelligence split between the people who own it and everyone else. We publish broad measures of labor’s share and income distribution, but nobody can isolate that number for AI yet. I’d want it more than any robot forecast.

Nobody reading this owns a robot fleet, so let me say what I’d tell a friend. Don’t own only your labor. If this scenario is even partly right, the balance between wages and capital tips hard toward capital, and you want some claim on the economy for when wages become a smaller one. A retirement account, a business, a piece of property, whatever your circumstances allow. Get good at the part that doesn’t get manufactured, which is judgment, and being the person who signs and answers for the result. Use the models every day on your own work so you’re the one directing them. And learn to live without a boss before you have to. Find the thing you’d do if nobody paid you and start doing it now, with other people. The meaning crisis will hit hardest the people who waited.

Own something and get good at judgment. Build a life that doesn’t need an employer to give it meaning. The technology doesn’t decide how this turns out. We do, and we’re behind.

I hope you enjoyed reading this. If you did, please share it with others.

Share Intelligence by Intent

The heat wave appears to be mostly over here in Los Angeles (thankfully!). Here’s Magnus cooling off on the travertine after a morning walk.

The Best AI Model Just Got Permission to Read Your Files. Are You Ready?

TL;DR. Claude Fable 5.1 shipped today (September 1st). Anthropic calls it the strongest knowledge-work model on the market and the early numbers back that up. It costs about 25% less wherever you pay by the token, and the 30-day data retention rule that kept law firms off Fable 5 is being replaced for business customers. Customers who qualify for the replacement get zero data retention in the meantime. The full replacement rolls out in phases starting later this fall, and Anthropic hasn’t published a date. The permission problem is nearly solved. The readiness problem is yours.

On June 9, Anthropic released the most capable model it had ever put on general sale, and a lawyer named Jessica Eaves Mathews did the one thing most buyers skip. She read the terms. She found a clause requiring every prompt and output on Fable 5 to sit on Anthropic’s servers for 30 days, with a small group of approved reviewers able to read any conversation the safety systems flagged for potential serious harm. Zero data retention, which every other Claude model on the API could run under, was off the table, even for enterprise contracts already signed.

For a law firm that ended the conversation. Most firms I talked to this summer never got as far as the benchmarks.

Here’s the claim I want to make. For most of the last three months the reason your firm didn’t use the best model was Anthropic’s fine print. Export controls pulled the model off the market entirely from June 12 to June 30, and once it came back the retention clause was what stood in the way. Starting this fall the fine print stops saying no, and what’s left is the harder question of whether your firm is ready to use it.

Retention versus training

People conflated two things this summer. Training is when a vendor uses your data to make its next model smarter. Anthropic committed in June not to do that with the retained data, and said flatly on September 1 that it has never trained on enterprise data without permission. Retention is when the vendor keeps a copy for a while, in this case to catch attacks that unfold across many sessions and accounts. That’s what Fable 5 required, and that’s what a confidentiality obligation can’t tolerate.

The fix, announced alongside Fable 5.1, is called Enterprise Frontier Safeguards. The data that monitoring needs gets stored in a cloud account you control, under your keys, with your access policies and your audit logs. Anthropic’s automated systems watch a rolling window for serious misuse. When they flag something, the flag goes to your people. By default nobody at Anthropic looks. Anthropic says it built this with more than 100 customers, law among them.

Two timing facts matter. EFS rolls out in phases starting later this fall, and no date has been published, so don’t plan a deployment around a week. And in the meantime, customers who qualify for EFS get zero data retention on Fable 5 and Fable 5.1 until EFS is ready. You request it through a form, and ask where your firm sits on the eligibility list while you’re at it. EFS itself is free. Your cloud provider bills you for the storage once it lands, plus reads, writes, and egress, the same as any other bucket.

So the permission question, which was a hard no in June, is now a yes with paperwork.

What the model does now

I like to focus the numbers that matter for knowledge work, so here are three.

Start with GDPval, because it’s the one built for people like us. OpenAI assembled it from 220 real work assignments across 44 occupations, legal among them, each written and graded by professionals with an average of 14 years in the field. Draft this memo. Build this spreadsheet. Prepare this deck. Artificial Analysis runs the test independently under the name GDPval-AA v2, gives the model a computer and a browser, and scores the results as an Elo rating, the chess system, with human professionals fixed at 1,000. Fable 5.1 sits at 1853, against 1723 for Fable 5 and 1824 for Opus 5. The number is live on the Artificial Analysis Intelligence Index page if you want to check it.

Here’s what 1853 means. The judges are a panel of frontier models, not people, and every matchup is blind. An 853-point gap over the human baseline says a judge would pick the model’s work over the professional’s about 99 times out of 100. Against Opus 5 the gap is 29 points, which works out to about 54 out of 100. So the human comparison is the headline. The Opus 5 vs Fable 5.1 comparison is a coin flip with a thumb on it.

On AutomationBench, which measures multi-step business workflows, it went from 17.1% to 31.4%. One caveat on that number, because Anthropic’s own footnote makes it. Fable 5 scored a zero on any task where its safeguards fired, so part of the jump is fewer false alarms rather than more skill. And on RedlineBench, a contract redlining test built by the AI law firm Crosby with micro1, it went from 47.9 to 57.0, with most of the gain on first-pass quality and smaller, cleaner edits.

That last one is the number I’d show a managing partner. Redlining is judgment work at the document level, and a nine-point jump in three months on the same test is not a rounding error.

Here’s a mechanism you can reuse. Pick one recurring piece of work at your firm, take twenty completed examples where you already know the right answer, run them through, and count. Where the toy breaks is the same place it always breaks. The misses cluster in the hard cases, the ones that were headed to a partner anyway. A stronger model shrinks that pile. It doesn’t remove the person standing next to it.

The cache read discount

If your firm is on a Max plan or premium Team seats, Fable comes with the plan up to half your weekly limit, and this section won’t move your invoice much. If you’re on Pro or standard Team seats, read on. Since July 20 those seats have paid for Fable through usage credits at API rates, so the cut lands on you too. And if you’re building on the API or through Bedrock, Azure, or Google Cloud, read it twice. The list price didn’t move: $10 per million input tokens, $50 per million output. What moved is cache reads, the charge for the model re-reading context it already processed. That fell from $1.00 to $0.25 per million tokens, a 75% cut. Anthropic’s own August usage data puts the blended saving at about 25% for typical work and up to about 45% for context-heavy agent work.

Think about what a litigation support app does. It reads the same 40,000 pages over and over. Those are cache reads, and cache reads just got cheaper. I said in July that the price of thinking keeps falling while the price of judgment hasn’t moved, and this is another rung on the same ladder.

The invisible signature

One worry I’d keep.

Every model Anthropic releases after August 2 carries an invisible watermark in its text, a requirement of the EU AI Act code of practice it signed in July. The watermark holds no information about you, your firm, or your matter. A detection API is in private preview for regulators, law enforcement, media, fact-checkers, researchers, and for companies with their own obligations under the Act.

I think this is fine today. But every brief and every deal memo touched by Fable 5.1 now carries a signature that a court or a regulator could one day read. If your firm hasn’t decided what it discloses about AI use and to whom, decide before the tool decides for you.

What to do Monday

1. Ask your Anthropic or cloud rep for the interim zero data retention agreement on Fable 5.1, and submit the EFS access form this week.

2. Pick one recurring piece of work, pull twenty finished examples, and score the model against them before anyone opens the tool on live matters.

3. Write down your AI disclosure position in one page, and put it in front of the executive committee.

Permission arrived. Readiness is your job.

Thanks for reading. I’ve had limited time to test Fable 5.1 so far, but my initial reactions are extremely positive. It’s also fast. Very fast. I’ll do more in-depth benchmarking on my real-world knowledge work this week and let you know it goes.

If you enjoyed this, please share with others and feel free to repost.

Share Intelligence by Intent

Both call it a project. Only one treats your chat as team property.

TL;DR. In a shared ChatGPT project, every member can read every conversation, and anyone can pick up a colleague’s thread and keep going. Claude keeps each chat with the person who ran it, and a shared chat (which you must manually do) is a snapshot you can read but not continue. For teamwork inside the product, ChatGPT wins. Claude’s answer to teamwork ships in Slack, and most law firms run Teams.

Set up a project in Claude and a project in ChatGPT and the screens look like siblings, right up to the button that decides who gets to read your chats. Name it. Write some instructions. Drag in files. Click share. Four minutes each, tops.

Then the two products do opposite things with that last click.

ChatGPT treats a conversation as team property. Claude treats it as yours. Everything below follows from those two sentences, including who reads the half-finished argument your associate abandoned at midnight.

The two share buttons

The timing explains the design, since Anthropic shipped Projects on June 25, 2024 and put a knowledge base at the center of it. OpenAI shipped Projects that December as a personal organizer, added sharing for business plans on September 25, 2025, and opened sharing to everyone a month later. One company started with a shared shelf. The other built a private drawer and later put a door in it.

On a Claude Team or Enterprise plan you pick visibility when you create the project. “Only people invited” keeps it yours. “Everyone at your organization” drops it into the Team tab, where any colleague can find it by browsing or searching and start their own chat inside it. Invited members get one of two roles. Can view lets someone read the knowledge and chat in the project, while can edit adds the power to rewrite the instructions and manage members. An owner can switch off organization-wide projects for the whole company, and when they do, the option disappears from the creation screen.

On ChatGPT Business, Enterprise or Edu, the owner shares by email, by workspace group, or by creating a workspace link. Two roles again, called chat and edit, and edit can invite people and change files though only the owner can remove anyone. The ceiling is 100 people and 40 files, and Enterprise admins can switch shared projects off or limit them by role.

So far, so similar. Now open the project.

What a new member sees

I run a two-question test before sharing anything. What does a new member see on day one, and what does the firm see after that member leaves.

Picture a twelve-lawyer litigation group, one shared project, 40 documents in it. The twelfth lawyer joins on Monday.

In ChatGPT she sees every chat the other eleven have run inside that project. Each thread carries its author’s name, and the files are hers to download too. ChatGPT may also pull context from her colleagues’ conversations when it answers her question, because a shared project runs on one pooled memory that belongs to the project.

In Claude she gets 40 documents and the project instructions. No conversations at all, and that holds even in a project shared with the entire firm. Anthropic’s help center is blunt about it. Claude won’t carry context from one chat in a project into another unless somebody puts it in the knowledge base, and each person’s project memory stays their own, invisible even to an owner.

Read-only or resumable

Everything above is about who can see the work, and teamwork turns on who can pick it up. I had that half wrong until I checked.

Claude does let you hand a colleague a conversation. You click Share, Claude makes a snapshot, and on Team and Enterprise that link only opens for people inside your organization. Your colleague can read the whole exchange. What she can’t do is keep going. The snapshot freezes at the moment you shared it. It drops your attached files and any raw connector data, and Anthropic documents no way for the recipient to add a turn. She gets a photograph of the work.

ChatGPT hands her the work. She opens your chat inside the shared project, continues it, and that continuation lands in the project as a branch next to your original. It carries her name, and the other eleven can see it. The loop closes without anyone copying anything into a new window. I like the branching. I’d like it less on a client matter.

Now the correction that cuts the other way, because none of this is really threading. OpenAI’s own FAQ says chats in shared projects can be branched, not worked on together, and two people cannot type into one thread. OpenAI did build a true shared thread, though never on the business plans. Group chats launched November 13, 2025 for consumer accounts and went global a week later. They started retiring it on July 9, 2026. OpenAI said the wind-down keeps the product simpler. Call what’s left an asynchronous relay, and a relay still beats a photograph.

Anthropic isn’t contesting that ground. Their answer shipped June 23, 2026 as Claude Tag, in beta for Team and Enterprise, and it lives in Slack. One @Claude per channel, everyone in the channel sees what it’s doing, and anyone can pick up where the last person stopped. Cat Wu, who runs product for Claude Code and Cowork, told Fortune that chat, Cowork and Claude Code are very single-player, and that Tag was built to be the opposite. Read that as the concession it is, because Anthropic doesn’t plan to win multiplayer inside claude.ai. They’re betting it happens where your team already talks.

Which is fine if your firm runs Slack. Most don’t. In the ABA’s 2024 legal technology survey, Microsoft Teams showed up at about 63% of attorneys using cloud tools, behind only Microsoft 365 itself, and Slack didn’t make the reported list at all. Anthropic’s own help center says Claude Tag works in Slack today. A Teams version doesn’t exist, and Anthropic hasn’t announced one. What a Microsoft firm gets instead is the Microsoft 365 connector, which lets Claude read your Teams conversations without joining them.

So the choice is narrower than it first looked. If the collaboration has to happen inside the AI, buy ChatGPT and it isn’t close. Claude’s answer exists only for firms already living in Slack, and the survey says yours probably runs Teams.

What the firm can see

Both products use “private” to mean private from your colleagues. Your firm is a different question.

On Claude Enterprise, the Compliance API pulls chat content and file content across Claude deployments, and audit events come through the same API. A Claude Team plan has no Compliance API, but the Primary Owner can run an organization data export that includes conversations and uploaded files, and individual members can’t export their own. On ChatGPT Enterprise and Edu, the Compliance Platform does the same job, and only a workspace owner can grant the conversation messages permission. On ChatGPT Business, data export isn’t available at all, and the switch that turns off shared links belongs to Enterprise.

Most firms I work with buy the middle tier. On ChatGPT that’s the tier where colleagues see the most of each other and the firm can retrieve the least.

Then an associate gives notice. Remove a member from a Claude organization and the rest of the team loses access to her chats, old snapshot links return “Conversation not found,” and a project she’d shared with the whole firm stays put in the Team tab. Do the same in a ChatGPT workspace and her projects transfer to a workspace owner, while the conversations inside them follow the workspace retention policy and stay invisible to the new owner. Both answers land in the same place. What survives a departure is the files and the instructions. The threads are weather.

The part that actually worries me has nothing to do with visibility. It’s membership. A shared project is an information barrier now, and the person who clicked share is the one maintaining it. Neither product knows anything about your conflicts system. Nobody gets an alert when the project that holds one client’s documents picks up its fourteenth member from three practice groups. I’ve argued before that AI makes execution cheap long before it makes judgment or governance cheap, and the control layer above the work becomes the scarce thing. A share button is part of that layer.

What to do Monday

1. Open every shared project in both tools and read the member list out loud against the matter team. Remove the names that don’t belong. Twenty minutes. Do this one first.

2. Put the collaborative work where collaboration actually works. A ChatGPT shared project for internal and non-client matters, and Claude for the client files you want staying with one lawyer. If somebody pitched you Claude Tag, check what your firm runs before you plan around it.

3. Pick who runs the export or the compliance pull, and have them run it once this quarter. A control you’ve never exercised isn’t a control.

What makes ChatGPT collaborative is exactly what you’ll have to govern.

One final note as I wrap up this article - I think firms need to think very clearly about how they want to work in projects and the approach they want as a firm around collaborative spaces. To me, this is absolutely a key criteria in the buying decision now.

I hope you enjoyed reading this article. If you did, please share it with colleagues and feel free to repost.

Ending with a photo of Magnus yesterday who was just chilling in the corner.

Claude Cowork will connect to your network drive. Then it will crawl.

TL;DR. If you point Claude Cowork at a folder that lives on a network drive, a shared server, or a synced cloud folder, everything slows down. My estimate is several times slower at the floor, and ten times or worse once you’re across thousands of files. Copy what you need onto your own machine, work there, and put the results back when you’re done. If the files are too big to copy, narrow what you’re asking for instead.

Cowork’s folder picker will accept your firm’s network drive without a word of warning. That’s the trap. It takes the path, tells you the folder is connected, and gives you no hint that you just made every task in that session several times slower.

Cowork doesn’t work inside your network drive. It works from your machine and reaches across to that drive for every single thing it needs. When the folder is on your own hard drive, the reach is instant. When it’s on a server down the hall or somewhere in the cloud, every reach waits on the network.

Connecting a folder and working in one are different things. The picker only handles the first.

A word on my numbers before we go further. I have not run a stopwatch on this. I built a model of the round trips Cowork makes and ran it at different file counts. The slowdown figures in this piece come out of that model, so treat them as estimates. I would rather tell you that than hand you a precise-looking number I made up.

What counts as a network drive

This catches more people than you’d expect, mostly because “network drive” doesn’t sound like it describes what your firm actually uses.

It probably does. A mapped drive letter is one. So is a folder IT shares across the office. So are OneDrive, SharePoint, Google Drive, Dropbox, and the desktop sync folder your document management system installs. Those folders sit in Finder or File Explorer next to everything else on your machine. The files themselves live somewhere else.

The synced folders are the worst of the bunch, which surprises people, because those are the ones that feel closest to home. What’s sitting on your disk is often just a placeholder. The real file has to come down from the cloud before Cowork can read a word of it, one document at a time.

Why the file count decides everything

When Cowork writes a script to pull information out of the pile, its thinking time barely changes whether you hand it fifty documents or five thousand. The fetching time changes with every one. So a small job on a network drive is mildly annoying, and a big job on the same drive is a different afternoon entirely. Run three hundred files and you’ll notice. Run three thousand and you’ll go get lunch.

That’s also the moment a lot of firms reach for Claude Code, which is what I reach for myself whenever the file count gets high. It doesn’t rescue you here. Claude Code works by searching across a whole folder tree, and searching is the one thing that scales directly with how many files you’ve got. Point it at a network drive and you’ve aimed the most file-hungry tool at the slowest possible place to put files.

One more thing, if your files are big. Scanned exhibits and deposition sets can run hundreds of megabytes each, and a thousand of those is a couple hundred gigabytes. At that size, copying to your laptop becomes its own problem. You’re still moving every one of those gigabytes, and they may not fit on the drive. When the files are that big, narrow the job instead. Tell Cowork you need the caption, the filing date, the page count, and nothing else, and it stops dragging whole documents across the wire to find them.

One rule fixes most of this, and it costs you nothing. Name the file you want. When you point Cowork at a folder and ask it to go find something, it has to search, and searching across a network drive is where your afternoon disappears.

Why IT says no to copying files local

Now for the part where I tell you to copy client files onto your laptop, and your general counsel stops me right there.

She’s right to. The files live on the share for a reason. Retention runs there. Ethical walls get enforced there. It’s where the record lives when a court comes asking. The firm spent a decade getting matter files off individual laptops, and “just copy it local” is the exact sentence that decade was spent fighting. I have never seen that objection lose an argument inside a firm, and it shouldn’t.

So make it a checkout. You take the smallest set of files that answers the question, you work on your own machine, you put the output back on the share, and you clear out the working copy when you’re finished. Written down, that’s a procedure your GC can approve in an afternoon. Left unwritten, it turns into associates keeping client folders in their Documents directory forever, which is a different problem and a worse one.

The scheduled run that wrote nothing

Slow is annoying. Slow is also visible, which makes it the good outcome.

The failure that worries me is the one you can’t see. On March 31, a user filed issue 41687 against Claude Code. His Z: drive was mapped to Zoho WorkDrive. Cowork on Windows accepted it in the folder picker and then failed to write a single file to it. On April 28, issue 54435 reported the same class of failure on a Mac. Scheduled collector runs against a synced Google Drive folder produced zero of sixteen expected files. That happened twice. Interactive chat sessions in the same session mounted the same folder and wrote to it fine. Anthropic closed both reports as “not planned.”

Both runs logged what went wrong. Nobody was reading. If you’re sitting at the screen, you see it. If it’s a task you scheduled to run overnight against a shared drive, that message lands in a transcript you’ll never open. You find out days later, when somebody goes looking for a document nobody wrote.

Slow costs you an afternoon. Unread costs you a deliverable.

None of this is a knock on the tool. The folder picker just needs to warn you before it takes the path.

What to do Monday

This is the same instinct you have about a case file. You don’t try to read a deposition through a window in another building. You go get it and bring it to your desk, and when you’re done it goes back on the shelf.

Three moves.

1. Connect the smallest folder that answers your question, and name the specific file in your prompt instead of asking Cowork to go hunting for it.

2. If those files live on a share, copy them to your machine first, do the work, put the result back, and clear the copy. Write that down as a checkout procedure and walk it past your GC this week.

3. Any time a task runs without you watching, open the destination folder and confirm the file is there. The summary will tell you it worked either way.

The picker will let you point at the share. Copy the files anyway.

Thank you for being a reader. If you enjoyed this, please share it with others.

Share Intelligence by Intent

Magnus definitely thinks this is his couch.

Google shipped the right strategy today. Then it couldn’t make me a spreadsheet.

TL;DR: Google Cloud launched Gemini Enterprise for Legal and for Financial Services, both in preview. The vertical packaging is the right call and the partner list is real. The trouble sits underneath. The enterprise router picks models that can’t finish the job, and the flagship Pro model has sat in preview since February, which under Google’s own terms means no SLA, no indemnity, no support, and no PHI. Open the file before you sign anything.

Thomas Kurian published a sentence this morning I’ve spent two years trying to get managing partners to say out loud. “Foundational model intelligence is necessary. For legal work, it is nowhere near sufficient.”

He’s right, and the whole post is right. Most serious models are good enough now. What decides whether a firm gets value is everything built around the model. Skills that carry your playbook, connectors into the matter itself, agents that finish work instead of suggesting it, and governance that lets risk management say yes.

Then I opened Gemini Enterprise and asked it to build me a spreadsheet.

Google made the best public argument I’ve read this year that the model is not the product. An hour later its own product proved the point, running the other way.

What Google actually shipped

Two industry solutions, announced together, both in preview. Legal debuts with Cleary Gottlieb, Freshfields, Weil, and Williams & Connolly as launch customers. Google built Financial Services with Deutsche Bank and CME Group as design partners. Healthcare and life sciences are next. Hold that thought.

The partner list is the part I’d read first. On the legal side Gemini connects into iManage and NetDocuments with document-level permissions and ethical walls intact, into Everlaw and RelativityOne for litigation evidence, into Docusign for contract obligations, and into CourtListener for dockets. Harvey and Legora are both in there, which is Google conceding that specialist legal AI keeps its own seat. Deloitte and Eudia ship agents on day one. Finance gets FactSet for market data, Moody’s for counterparty risk, PitchBook for private markets and SEC Edgar for filings. All of it feeds a Google-built research agent that carries more than fifty skills and cites its sources.

I’ve argued for a while that the next advantage comes from redesigning how work moves through a firm. This launch is that argument with a price tag on it. It’s also not sold where most professionals work. Gemini Enterprise is a separate Google Cloud platform starting around $21 per seat, and $30 if you need the compliance controls. If your firm runs Workspace, none of this reaches you.

The spreadsheet that never came

I was in Gemini Enterprise with Auto selected, the setting that lets Google pick the model for you. I asked for a multi-year income statement, cash flow statement and balance sheet for a made-up B2B SaaS company, with an assumptions page, formulas tying throughout, a charts tab and a dashboard up front. Standard CFO homework, as an Excel file with a download link.

It went off, told me it was calling agents, worked for a while, and announced it was done. No link.

So I asked where the file was. It apologized, blamed a missing software library, and promised a coding agent would fix it. Nothing happened. When I asked again it named a library as the problem: xlsxwriter (not sure how that really helps me). Then it offered me CSVs instead.

I asked then to create this in Google Sheets. Couldn’t do that either. I got a pile of CSVs and instructions to import each one by hand. So much for formulas that tie.

So I opened a fresh session in my Gemini Enterprise and selected Gemini 3.7 Flash, which I know builds Excel files because I’ve watched it work great in Antigravity. It built one. I downloaded it and it had a circular reference. Oops. High thinking would have fixed that. And Enterprise gives you no way to turn the reasoning effort up, so I couldn’t give it more room.

Gemini 3.7 Flash can build a workbook. Gemini Enterprise on Auto couldn’t get me one. That gap is the whole product.

Here’s the cheapest test in AI procurement. Run the artifact your work actually ends in, three times, on every model you’re licensed for. Not a question. A file. Then open the file.

One failure isn’t a verdict. Models miss, and a formula-linked workbook is about the hardest thing you can ask for. The failure that counts is different. The router picked a model that couldn’t do the job, the system told me it was done when it wasn’t, and nothing in the interface let me overrule the choice.

The strongest objection here is a good one, so give it its weight. Gemini Enterprise for Legal isn’t a spreadsheet tool. It’s a governed retrieval and agent platform, and by that measure permissioned access into iManage and Everlaw is exactly what firms have been asking for since 2023. The model picker is a Vertex concern. Different problem, different team.

Fair. And it still lands on the same router.

Skills and connectors don’t run themselves. They run on a model selection you can’t see or override, and their output lands in a file that goes to a client. Governance you can audit, sitting on a selection you can’t, is a thinner promise than it looks.

Three pickers, one brand

Open the model menu in consumer Gemini, Workspace, and Enterprise on the same day and you get three different answers.

Consumer has 3.7 Flash, flagged as new, plus 3.5 Flash-Lite, 3.1 Pro, and a toggle for extended thinking. Workspace tops out at 3.6 Flash and a thinking variant. Enterprise lists six models, three of them Flash releases with word-for-word identical descriptions, and no thinking control at all. Consumers get the newest models and the most control over how hard the model works. Enterprise buyers, paying the most and carrying the most risk, get the least.

Gemini 2.5 Pro, from 2025, is still on the enterprise menu. My read is that it’s there because it’s the only Pro model that’s generally available. Gemini 3.1 Pro went to preview on February 19 and Google said general availability would follow soon. Today is August 25. That’s six months of soon. Gemini 3.5 Pro never arrived at all. Google announced it at I/O in May targeting June, and CNBC reported in July that it fell short internally on coding.

Meanwhile the Flash line ships almost monthly, and 3.7 Flash costs $0.75 per million input tokens against $2.00 for 3.1 Pro. That $0.75 is an introductory rate through December 31, and it doubles after that. Even at the doubled rate you’re paying a premium for an older generation because it wears the Pro badge.

The fine print on preview

Preview isn’t a maturity label. It’s a set of contract terms, and Google publishes them.

Read the Pre-GA Offerings Terms in Google Cloud’s Service Specific Terms. Here’s what you’ve signed. There’s no SLA and no Google indemnity, which is the IP indemnity your general counsel asks about first. Technical support doesn’t cover it by default. The data location commitments don’t apply, which bites if you have residency obligations. Google can change, suspend or discontinue the model at any time without notice, and it caps its own liability for a preview offering at $25,000.

Then there’s the part I checked twice. Gemini Enterprise is on Google’s covered products list, so the platform itself is fine. The exclusion lands one layer down. The Service Specific Terms define a Pre-GA Offering to include models labeled Preview, and the HIPAA page tells customers not to use pre-GA offerings with protected health information. The preview notice on 3.1 Pro does allow production use and personal data under the data processing addendum, but personal data under that addendum is not PHI under a BAA. So if you hold a signed BAA, the platform is covered and Google’s most capable reasoning model still isn’t. Not discouraged. Excluded.

Now hold that against the roadmap. Google announced today that healthcare and life sciences verticals are coming. Its flagship reasoning model has been off limits for PHI since February.

Don’t assume that’s somebody else’s problem. Med mal defense, ERISA and health plan work, health system outside counsel. Plenty of firms touch PHI, and Gemini Enterprise for Legal is in preview too.

There’s one more worry buried in the timing. Google confirmed in July that it’s training Gemini 4 and called it its most ambitious pre-training run yet. Pichai told analysts days later that the next frontier needs a much larger base model. I believe them, and I think Gemini 4 fixes the frontier problem. It also means Google replaces the model layer under everything it announced today. Firms piloting a preview product on a preview model, with a new generation inbound, are not piloting what they’ll run. I wouldn’t sign a twelve-month commitment in front of that.

Here’s a call you can grade me on. Google ships its healthcare vertical before 3.1 Pro reaches general availability. Check back in January.

What I’d tell a managing partner

Kurian wrote that model intelligence is necessary and not sufficient. That’s the thesis of my whole practice, and Google published it better than I have. The gap is that the sentence applies to Google too.

Three moves. Run the artifact test this week on whatever stack you’re evaluating, including this one, and count how many times you got a working file instead of an apology. Get it in writing which model executes which task, whether you can pin it, and whether that model is GA, because Auto is a routing decision someone in your firm should own. And if you’re under a BAA, fence the preview models off today rather than waiting for the vertical to ship.

I love these models. I still can’t recommend the stack.

Google wrote that line. Google should read it back.

Thank you for reading. If you enjoyed this, please consider reposting and sharing with others.

Magnus is super food motivated. Here is is patiently waiting for a string cheese from my son. Hopefully this heat will break in Los Angeles soon so we can go on longer outdoor walks again.

ChatGPT can read your texts now. Your clients never agreed to that.

TL;DR. On August 20 OpenAI shipped an Apple Messages plugin for ChatGPT on the Mac. Most of the argument since has been about whether OpenAI copies your texts to its servers. That’s the wrong fight. Your Messages archive is mostly other people’s words held in your custody, and no device permission has ever been able to ask about that.

The clearest privacy rule in law isn’t filed under privacy. It’s the client trust account.

Money sits in an account with your name on it, and you can move it with one click. Every lawyer learns in the first month that it isn’t your money. Possession isn’t ownership. You’re holding something for someone else, and the rules that apply are theirs.

Nobody has explained that to macOS.

The plugin searches your iMessage, SMS and RCS history, summarizes threads, drafts replies, and sends them as you. It’s on every plan including the free one, and runs on Apple Silicon Macs inside ChatGPT Work and Codex.

Most of the argument since launch has been about whether OpenAI copies your texts to its servers. The company says there’s no full index, the plugin runs locally, and it reads only when you ask. Fine. I’ll take them at their word on the mechanics, because it’s the wrong fight anyway. The permission dialog asks whether you own the computer. It can’t ask the question that matters, which is whether you have the authority to hand over what’s sitting on it.

The delete that worked anyway

There’s a rule worth carrying into your next vendor meeting, and it has nothing to do with OpenAI.

In June 2025, Simon Willison named what he called the lethal trifecta. Three capabilities:

• Access to private data

• Exposure to content that a stranger writes

• A way to send things back out

Any one of those is fine, and any two are usually fine. Put all three in one system and a stranger can write text that your AI reads as an instruction and then acts on with your data and your name. The attacker needs no password. He needs a message you’ll read.

Now look at where the three legs sit. The archive is the private data. Anyone with your phone number supplies the untrusted content, because a text is words a stranger wrote that your AI now reads. The hands come from Computer Use, which is the part of ChatGPT that sees your screen and drives your apps. Plugins share it. I checked on my own Mac, and switching off Computer Use’s permissions stops Messages working. Those permissions cover Full Disk Access, Automation, Contacts, Accessibility, and Screen Recording, which I haven’t seen one article mention.

Ben Patterson at PCWorld hit this by accident on August 21. He asked ChatGPT to delete some spam texts. The Messages plugin reads, searches, drafts and sends, and it can’t delete anything. So the agent found another route. Patterson watched screenshots of his own Messages window appear while ChatGPT took his mouse and clicked Delete. It had reached across to Computer Use, which he’d granted for an unrelated test weeks earlier and never switched off.

Nothing broke. Every permission involved was one he’d given. And notice what the plugin’s limit turned out to be worth. It couldn’t delete, so the agent reached past it and deleted anyway. That limit was a feature boundary. Nobody had built it as a security one.

One caveat worth saying out loud. The rule tells you the shape of the exposure, not the odds. OpenAI wrote back in December that prompt injection is unlikely to ever be fully solved. Its word, not mine. On May 1 six governments published joint guidance called Careful Adoption of Agentic AI Services, and its central recommendation is to keep agentic systems on low-risk, non-sensitive work for now. A Messages archive full of client texts is the opposite of that.

The consent you can’t give

Now the part that should stop a lawyer cold.

Your Messages archive isn’t a record you made. It’s a joint record. Most of the words in it were typed by other people, and every one of them decided what to tell you based on who you are.

A client texts you at 11pm about a custody exchange that went badly. Another sends a photo of an injury. Someone forwards a number they were told to keep quiet. Each of them made a judgment about you. None of them made a judgment about a third-party AI vendor, and nobody asked them to.

The strongest case on the other side came from 9to5Mac, and it deserves its full weight. Their read runs like this. It’s an opt-in feature, not a sketchy workaround, and it uses files already sitting on your Mac with your permission. It doesn’t build a standing index the way Siri does. ChatGPT touches the data only when you point it there, and the app is clear on screen about what it’s doing. For those reasons, they wrote, it shouldn’t be a privacy concern for Apple.

Every clause of that is true. All of it is about you.

Consent-by-installation works when the installer is the only person in the data. Open a Messages archive and you’re the minority author. The people who filled it have no toggle, no notice, and no way to opt out. No vendor designed that gap. It’s a limit on what a device permission can express. Mine couldn’t even tell me which app was holding it.

For a lawyer this stops being philosophy around the second paragraph and becomes Rule 1.6, which is binding, read through guidance that isn’t. California replaced its 2023 AI guidance in May 2026, at the request of the state Supreme Court, to address agentic AI. It says poorly configured agentic systems can disclose confidential information across matters and expose privileged material. It says a lawyer must not deploy one that transmits client information externally on its own without safeguards and human review. Read that second half. It isn’t a ban. It’s a condition. Safeguards, and a person who looks before it goes.

Here’s a screenshot from my actual usage of the messages plugin in Codex (with phone #’s and names blocked). I went to LMU for my undergrad (go Lions!) and this is a recent exchange about the upcoming Alumni BBQ.

The checkbox at the end

By default the plugin shows you the message and the recipients and waits. That confirmation is the entire safety story, and OpenAI says as much. The company tells you to keep per-send approval on for any chat that might carry untrusted instructions.

There’s a documented defect nearby, and it isn’t the interesting part. If a task runs with full access, Messages may not be able to show the confirmation at all, so the text doesn’t go. That fails safe.

What fails open is a checkbox. Pick “Always allow sending to this chat” and ChatGPT can text that person again without asking you first. OpenAI says so in the same paragraph where it offers the setting. Persistent approval, it says, removes your final chance to review a message before ChatGPT sends it as you.

Capability isn’t authority. The question to ask of any system is what it can do before one of your lawyers gets a chance to say no. On a default install that answer is nothing, which is honestly good design. Tick one box and the answer changes, and nobody sends you a notice when it does.

What to do Monday morning

Which brings me back to the account with your name on it.

You could move that money today and the bank wouldn’t stop you. What stops you is that it isn’t yours and you know it. The whole system runs on a lawyer holding a line the software can’t see.

Same thing here. A macOS permission is a question about your hardware. Rule 1.6 is a question about your custody. One toggle can’t answer both, and only one of them ever gets asked.

So, three moves.

1. Ask of any AI tool what it can reach when it hits a wall. The feature list won’t tell you, and Patterson found out by watching his own cursor move.

2. Decide who at your firm gets to say yes on behalf of people who aren’t in the room. Write it down before somebody needs it.

3. If you run a managed workspace, switch Apple Messages off through the existing Computer Use control. That beats a policy memo nobody reads.

I don’t think this plugin is a scandal. I think it’s an ordinary product decision that quietly moved a line, and the line it moved is one lawyers are paid to hold.

Possession was never permission.

If you enjoyed this, please repost and share with others.

Share Intelligence by Intent

In the last newsletter I said Magnus was getting a bath. He did (well, when I give him a bath it feels like I get one too every time he shakes water off his body). Here’s a picture of him sitting in my office this morning - all clean!

OpenAI Published What It Costs to Watch an AI. Your Firm Hasn’t Priced It.

TL;DR: On August 18, OpenAI said it had paused two weeks of training and put its largest planned frontier run on hold. It also said monitoring now costs it roughly 20 percent extra compute. That’s the first real price tag anyone has put on AI containment. Firms have been told for a year to add approval gates and audit logs. Almost nobody has costed either one, and a law firm pays that bill in the only thing it sells.

Twice this summer I told firms to put gates and logs on their AI agents. In July I wrote that somebody at the firm should know what an agent can reach before you connect it to email and matter files. In August I wrote that if you can’t log an agent’s actions, you shouldn’t give it high-stakes actions.

Both times I skipped the question a CFO asks first. What does that cost?

I skipped it because I didn’t have a number. Now there’s one, and it came from the company with the most reason to keep it quiet.

Here’s what that changes. Containment has a running cost that arrives every month, and OpenAI just published theirs. They pay it in compute, because compute is what OpenAI sells. Your firm is going to pay it in hours.

What OpenAI paid

On August 18 the company published what its own safety work has cost so far, and the line that stopped me was the boring one.

Monitoring now runs at roughly 20 percent of the inference compute being monitored. OpenAI adds that the number moves around a lot depending on the workload, so treat it as a ballpark rather than a rate card. Even as a ballpark it’s startling. To watch a model work, OpenAI spends about a fifth again of what it costs to run the model at all.

The rest of the bill is time. The company paused two weeks of training on models headed for release. Its largest planned frontier run is still on hold. In its own words, meeting the new security standard took substantial engineering work and cost the research program delay. A lot of internal work stays frozen until it clears the higher bar.

I keep wanting that 20 percent to be the headline number, and it isn’t quite. It’s the closest thing anyone has published, which is a weaker claim and the only one I can defend. Nobody outside the labs has put out anything comparable.

No regulator forced any of that. OpenAI looked at what its models did in July and decided its containment wasn’t good enough. Then it paid.

The watching bill

Now do your version of the math. I’m keeping the numbers round on purpose.

Say you run one agent that summarizes incoming records into a matter file. Four hundred a month. Running the model costs you about what lunch costs. Call it twenty dollars. Now put a paralegal at the gate for three minutes on each one, because your policy says a person reviews before anything lands in the file. That’s twenty hours a month, every month, forever. Twenty dollars of compute against twenty hours of a paralegal. Put your own rate on the hours and you have the ratio.

That’s where most firms stop reading and decide the gate is optional.

My math assumes something false, though. It treats all four hundred summaries as equally worth reviewing, and they aren’t. Maybe fifteen of them touch something that matters, and the trouble is that nobody knows which fifteen in advance. Reviewing all four hundred at three minutes each is how you buy the appearance of oversight at the price of the real thing.

Which is the problem OpenAI solved with money. Automated monitoring watches everything, and that’s what the 20 percent buys. Humans get pulled in only when the system thinks a real boundary got crossed. Then there’s a clock, and this is the part worth stealing. The teams have thirty minutes to establish that an alert is a false positive. If they can’t, the activity gets paused.

Read that last part again. The default when the clock runs out is stop. Almost every firm policy I’ve seen defaults to continue.

The gate that quietly opens

The strongest objection here is that firms already handle this, and it usually arrives in one sentence. We have a human in the loop.

I believe you. KPMG asked technology leaders about exactly this in its first-quarter pulse survey. Seventy percent said a person validates the agent’s outputs without overseeing each action or decision it takes along the way. That was the technology sector, which is about as sophisticated as buyers get on this.

Look at what that sentence actually describes.

Someone checking outputs is reviewing what the agent produced. Nobody is watching what the agent did to produce it. And a human in the loop four hundred times a month is a human clicking approve, because attention doesn’t scale and nobody ever budgeted for it to. You’ve bought a control that shows up in the policy and stops working around week three.

Hugging Face is the proof, and I’d bet they’re better instrumented than any firm reading this. During the July intrusion their security stack pulled scattered signals together and correctly resolved them into an attack. Then it failed to mark the alert critical. Nobody got paged. The response lost time it couldn’t spare, against an agent that ran roughly 17,600 actions and went from one compromised worker to admin rights across internal clusters in under thirteen hours.

The alert fired. The attention wasn’t there to receive it.

Buying attention back

Here’s the part that worries me most, and it isn’t the technology.

The ledger is rigged against watching. When an agent saves your team nine hours a week, you see nine hours. When your oversight quietly stops working, you see nothing at all, right up until the week you see everything. A firm doing honest math on what it can measure will keep choosing to skip the gate, and that math will look correct every quarter until it doesn’t.

I went looking for what firms actually budget for AI oversight. There’s no such number. Vendors publish agent pricing and seat pricing. Nobody publishes the watching cost, and I don’t think that’s an accident. It’s the part of the pitch that makes the ROI slide worse.

So price it yourself. Three moves.

Pick one agent already running in your firm and put a dollar figure on a month of watching it. Use real review minutes and a real hourly cost. Then buy automation for the routine layer so a person enters only on escalation, because a paralegal reviewing four hundred summaries is the most expensive way to catch fifteen problems. And write down what happens when nobody can tell whether an alert is real. Give it a clock, and make the answer stop.

That’s the CFO question I should have asked in July.

The gate is cheap. The attention behind it never was.

If you enjoyed this article, please share it with others.

It’s bath day today for Magnus and he absolutely loves it! Next article will have photos of him all clean! Here’s a shot of him resting next to Sherlock. Amazingly, they are best buds. ;)

Wispr Flow for lawyers: better AI answers, and the privacy setup you need first

You open a chat with Claude. You have a client situation in your head with twenty pieces of background. You type four, because the other sixteen would eat ten minutes you don’t have. The answer comes back generic and you blame Opus.

The model was fine. You starved it.

I fixed that with a dictation app called Wispr Flow. Talking runs about three times faster than typing, so all twenty pieces make it into the prompt instead of four. Then comes the question every lawyer asks next, which is whether a cloud dictation tool has any business touching privileged material. It does, and the setup takes two settings, not one.

Context is the whole game

Output tracks input. Give a model the matter history, the other side’s position, what your client wants, and the two facts that make this one weird, and you get something usable. Give it a sentence and you get a search result with better grammar.

Typing is what stops most people. A Stanford study by Ruan and colleagues clocked speech input at about 161 words per minute against 53 for the keyboard, with a lower error rate for speech. Ordinary conversation runs near 150 words a minute. Most people type between 40 and 50.

When context costs twenty seconds instead of five minutes, you hand over all of it. Voice is the fastest interface we have for feeding these tools, which is why I count a dictation app among my AI tools.

What Wispr Flow is

Wispr Flow drops formatted text into whatever app you are in. Word, Outlook, your practice management system, the prompt box of any AI tool. Hold a key, talk, let go, and clean text appears. Mac, Windows, iOS, Android, over 100 languages. Pro runs $15 a month, or $12 billed annually.

I don’t normally name or endorse tools in this newsletter. That is deliberate. But I have used Flow nearly every day for just over a year, and I have spoken more than 100,000 words into it. At an average keyboard that is about 40 hours of typing. Spoken, it is closer to 11, and even after cleanup the gap is not close. So I am making an exception.

There is also no new workflow attached, which is the reason it survives contact with a law firm. Nobody has to learn a new place to do their work.

Attorneys can use it. The setup is what matters.

I ran a one-on-one training session with a partner this week. She had watched me dictate a few paragraphs of context into a prompt during a demo, and she asked the question I get most often. Can I use that on client work?

Yes, with conditions. Her question is why I wrote this article.

ABA Formal Opinion 512, issued July 29, 2024, applies Model Rule 1.6 here. You evaluate a tool before client information goes into it, and tools that train on your inputs require informed client consent, not boilerplate in the engagement letter. So the target is simple. Your dictation must never train a model and never sit on somebody else’s server.

Wispr uses two separate controls, and you need both. Privacy Mode governs training. Cloud Sync governs storage. Wispr’s security FAQ defines zero data retention as Privacy Mode on plus Cloud Sync off. Flip Privacy Mode alone and you have stopped the training while your audio, transcripts and dictation history keep landing on their servers.

On Enterprise, an admin sets both at admin.wisprflow.ai. Privacy Mode to “Enforced for everyone.” Private Cloud Sync to “Disabled for everyone.” Get both right and the portal reads “Zero Data Retention Enforced,” and no user can override it. The difference is enforcement. A setting that is merely available is a setting somebody can turn off.

Set the local device policy while you are in there. Flow can store transcripts on the machine, delete them after 24 hours, or never write them at all.

What zero data retention does not cover

• Custom dictionaries and snippets sync to Wispr’s servers no matter how you set the two switches. Wispr calls them productivity assets rather than dictation content. That holds up until you remember a litigator’s dictionary is mostly client names and matter numbers.

• Context Awareness lets Flow read text already open on your screen, so more leaves the machine than the words you spoke. The text-reading half is on by default and keeps formatting consistent with the document you are in. Under enforced ZDR, Wispr keeps none of it, so leave it on. Without ZDR it can sit alongside your transcript, and that is the setup to avoid. The screenshot half, which pulls proper nouns off your display, is off by default. Leave it off.

• Android has no Data and Privacy section. No Privacy Mode toggle, no Cloud Sync control. Wispr’s documentation does not spell out how org-level enforcement reaches those phones. If your people dictate on Android, put that question to Wispr in writing first.

• All processing happens in the United States. No on-premise version, no EU region.

• Wispr invalidated its own SOC 2 Type II and ISO 27001 certificates in March 2026 after integrity problems at the original auditor, and said so publicly. A-LIGN completed a Type I in April 2026, with Type II underway. If your policy demands a current Type II, ask where it stands. I know this one is in the weeds, but for some of you, this really matters!

None of this discharges your duty to vet the vendor. It gets you to where the vetting can come back clean.

What to do next

1. Buy Enterprise, then have your admin set both dropdowns and confirm the portal reads “Zero Data Retention Enforced.” Privacy Mode by itself is not enough.

2. Pull the DPA and the SOC 2 report from Wispr’s Trust Center, and request a BAA if you touch PHI. Name Wispr in your written AI policy.

3. Tell everyone the dictionary syncs. No client names in there, no matter numbers.

The privacy work takes an afternoon. The habit takes about a week. After that, watching someone type a paragraph of context into a prompt box feels like watching them fax it.

I truly do use Wispr Flow every day. It has been a game changer for me and I think it will be for you too. If you enjoyed this article, please share it with others.

Share Intelligence by Intent

Magnus was having a chill day on the couch yesterday when he decided he wanted a little snuggle time.

Most of the legal profession is using AI in the dark. Your state bar holds the flashlight.

TL;DR: 69% of legal professionals now use general-purpose AI for work, more than double a year ago, while over 1,300 US court decisions already involve AI-fabricated material and malpractice insurers are seeing the first wave of AI-related claims. I spent the past week coding every state’s official AI guidance, and I came away with one conviction. Bar guidance isn’t bureaucratic noise. It’s the only thing standing between a duty you already have and a sanctions order with your name on it.

There’s a lawyer I keep picturing. She’s good at her job, busy, and somewhere around last spring she started pasting things into ChatGPT. A demand letter here, a research question there. She’s careful about it. She’s also never told a soul at her firm, because she has no idea whether she’s allowed to be doing this.

If that’s you, or half your firm, you’re in the majority. 8am’s 2026 Legal Industry Report, which surveyed more than 1,300 legal professionals last fall, found 69% now use general-purpose AI tools for work, up from 31% a year earlier. Adoption more than doubled in twelve months. I can’t think of another tool in law practice that spread that fast. Email didn’t. E-filing certainly didn’t.

And most of it is happening exactly like my imaginary lawyer: quietly, without rules, in the dark. The same survey found fewer than half of firms train their people on responsible use.

The question nobody can answer alone

I just finished a research project I’d wanted to do for months: I pulled the official AI guidance from all 50 states, every ethics opinion, court rule, and adopted policy I could verify against primary sources, and coded each state on the three questions lawyers actually ask. Can client information go into the tool? Do I have to tell anyone? What do I have to check before I file?

Here’s the thing that struck me while reading opinion after opinion. Your professional rules already answer these questions. Competence, confidentiality, candor. Those duties attached to AI the moment you opened a browser tab. What they don’t do is tell you where the lines sit. Rule 1.6 was written for a world of file cabinets and fax machines. Whether “reasonable efforts” lets you use a consumer chatbot on a client matter is a judgment call, and the person who makes it, if your bar hasn’t, is a disciplinary board reading your file after something went wrong.

That’s what bar guidance is. Not permission. Notice. It tells you which judgment calls your regulator has already made, before you bet your license on guessing.

What happens where guidance is missing

The states that stayed silent didn’t stay safe. They just moved the rulemaking into the enforcement phase.

Iowa is my favorite example because it’s so clean. Iowa has never issued a word of AI guidance for attorneys. In May 2026, Iowa’s disciplinary board publicly reprimanded a lawyer anyway, for filing AI-fabricated citations. Utah has no ethics opinion on AI either; its court of appeals sanctioned lawyers last year and made clear that the duty to review and verify a filing stays with the attorney who signs it. The rules got made in both states. They were just announced through individual lawyers’ disciplinary records instead of through guidance everyone could read first.

And the volume behind those anecdotes is bigger than most attorneys realize. The standard tracker of these incidents, a database maintained by researcher Damien Charlotin, counts more than 1,900 court decisions worldwide involving AI-fabricated material, over 1,300 of them in US courts, as of August 19, 2026. When I checked, the newest entry was a day old. The penalties are climbing. The famous 2023 case that started all this ended in a $5,000 fine. By 2026 courts were handing out $15,000 per attorney and, in a few cases, suspensions.

One detail from that database stuck with me. Most hallucination cases involve people representing themselves, and courts are pretty forgiving with them. The lawyer cases are fewer, and those are the ones that end in fines, referrals, and suspensions. Judges tend to extend grace to laypeople. They extend far less to the licensed professional who certified the filing.

Your insurer got here before you did

One development I’d flag for any managing partner. In EPIC’s annual survey of lawyers’ professional liability insurers, seven of thirteen carriers reported an increase in AI-related claims this year. Underwriters have been asking firms AI questions for several years now; what changed in 2026 is that the claims finally showed up. And what carriers want, in the words of the broker who runs that survey, is evidence that firms understand the risks and are taking meaningful steps.

Think about what the cheapest credible evidence of “meaningful steps” looks like for a five-lawyer firm. It’s not a custom AI governance program. It’s a one-page policy that says: we follow our state bar’s guidance, here’s how. The bar opinion you haven’t read is sitting there waiting to become your insurance documentation.

There’s an upside case too, and I don’t want to bury it. Clio’s 2025 Legal Trends Report found firms with wide AI adoption were nearly three times more likely to report revenue growth. More than half of consumers have now used or would consider AI for a legal question, and among those who did, 28% got told by the chatbot to go hire a lawyer. Your clients are arriving pre-loaded with AI expectations. Guidance is what lets you meet them without flinching.

What the guidance says, in one breath

Forty states have now adopted something official, counting only real instruments: ethics opinions, court rules and orders, and guidance a bar or court actually adopted, not staff articles in bar magazines or unadopted committee drafts. Only 36 of the forty speak to attorneys directly.

Read them all and a playbook emerges that you could teach in an afternoon. Verify everything AI produces before you rely on it; 34 states say so explicitly and none says otherwise.

Vet the tool before client data goes in, and in a handful of states (Georgia, Missouri, New Hampshire) get informed client consent first.

And the part that surprised me most? You mostly don’t have to confess. Nine states have expressly rejected mandatory disclosure of AI use to courts, New York loudest among them. The regulators mostly landed on treating AI like any other tool. You own the output. The tool itself is beside the point in most states.

The catch is which playbook applies to you depends on your state, and the differences are real. The same associate doing the same work is compliant in Richmond and exposed in Atlanta. Which is exactly why the generic advice circulating on LinkedIn isn’t enough. You need your state’s answer.

The honest caveats

Most of this guidance is advisory, not binding law, and a skeptic could wave it off on those grounds. I’d push back: advisory guidance is precisely what your disciplinary board will cite when a complaint lands, and what a plaintiff’s expert will cite in a malpractice case. Ignoring it because it isn’t a statute is a bet I wouldn’t make with my license.

The other caveat is speed. Fifteen states’ current guidance was issued or revised in the first eight months of 2026 alone. Whatever you read on this topic, including this piece, check the date on it.

What to do Monday morning

1. Find your state’s guidance and read the document itself, not a summary. Many run just a few pages. If your state is one of the ten with nothing, read ABA Formal Opinion 512; it’s the national baseline the state opinions themselves build on.

2. Write the one-page firm policy: which tools are approved, what never goes into them, who verifies output before filing. Anchor every line to your bar’s guidance so it doubles as your answer when the insurance renewal asks.

3. Tell your clients how you use AI, in the engagement letter. Two states require it, half the country says it depends, and every client relationship survives transparency better than surprise.

The lawyer I described at the top isn’t reckless. She’s just working without notice of the rules, in a profession that punishes exactly that. In 40 states, the bar or the court has done something quietly valuable. It wrote the rules down before the sanctions hearing. The flashlight exists.

Pick it up.

Note to the reader: a ton of research went into this and I’m sure I made a mistake or two (or more!). Any mistakes are mine. I did use AI to try and cross-check all of the data but at the end - it’s my output and I “own” it ;)

I hope you found this useful. If you did, please share it with others!

Share Intelligence by Intent

Last, here’s a shot of Magnus hanging out in the shade next to me while I enjoy a nice soak in the jacuzzi.

You Picked The Wrong Mode And The Answer Still Looked Fine

Every time I do a training session, this question always comes up. You’ve shown us that Claude has both “Chat” and “Cowork.” How do I know when to choose each one?

It happened again this past week. I was doing a training session, and someone asked that exact question. “How do I know which one to use?” Why would I choose one or the other? I said, “Let’s talk about a real-world workflow you’re doing these days.” What have you been working on?

She said, let me show you exactly what I was doing yesterday. I’ve been running this same process for a while now. I open up a transcript from a trial we’re working on, copy a section out of it, and then paste it into Claude. I have a detailed prompt that I copy and paste that creates a summary. Once Claude is done summarizing, I copy that text out and put it in a Word file. Then I scroll down into another section of the trial document and repeat the process. Sometimes I’ll do 10, 12, 15 transcripts in a day, and it will actually take me most of the day.

The truth is, nothing she was doing was technically wrong. Her prompt was good (she had even used Claude to make it better), and her summaries were great. She is smart, competent, and an AI leader in the organization, so I want to make sure she keeps having success with Claude. The challenge here wasn’t that she was using the tool badly. It’s that she chose the wrong mode.

TL;DR: Chat is for having a conversation. Cowork is for having Claude take action on documents for you. When you use the chat mode interface, you (the human) are deeply involved in ongoing interactions with chat. With Cowork, you give it a ton of context, the instructions, and say go. You still have to engage at the end, but you aren’t involved in every single step of the way making decisions.

Chat Is “Help Me With This.” Cowork Is “Handle This For Me”

When you are using chat mode, you (the human) are involved in every interaction. You get the results, read them, and decide what to do next. Ask another question, head in a different direction. When you are using Cowork, you give Claude a lot of context and a job to do and then let it run. Cowork will create the steps and then take action on its own.

One of the things I’ve seen attorneys get wrong again and again, though, is the following. They think that “easy” questions go into chat and “harder” questions go into Cowork. I get the instinct, but unfortunately it’s completely wrong. Making that decision is how an attorney ends up with a 20-minute Cowork process to rewrite a single paragraph.

When The Same Task Can Be Run In Either Mode

If you want to summarize a single deposition, put it into a chat. When you want to summarize 20+ depositions and also look for contradictions, use Cowork. The legal thinking involved in the underlying analysis is similar, but the process is different.

Asking Claude whether a contract has a “limitation of liability” problem is an issue for Chat. Checking 50 vendor contracts in a folder for the same problem is Cowork. It’s the same question being asked, just across 50 different documents. What is different here is the volume of documents you want to process and the steps you have to go through to get that work done. When using chat, the most common output most people ask for is just text. When using Cowork, most people typically want Claude to create an output document (say a “document log.”)

How To Choose: Look At These Three Signals

I tell clients there are three easy ideas that help you decide if this is a question for Chat or a task for Cowork:

First, it’s a question of volume. Are there more documents than you can upload into a chat or a project? If you have a small handful of documents, I would consider choosing Chat. If you have a folder with 20+ documents to analyze, that decision is a no-brainer: choose Cowork.

Second, if getting to the analysis or answer you want requires multiple steps (e.g., you’re doing a process), choose Cowork. Cowork is great at following a detailed set of steps (do this first, and then do that).

Third, if the output you want is a document (a Word doc, a text file, a PDF, an Excel spreadsheet, a PowerPoint), then use Cowork. You can even open the output document and view it right there in the Claude desktop app.

One thing to keep in mind (I was a CFO after all so I’m always thinking about cost) is that Cowork definitely takes more tokens (it’s typically running a more complex process), so you’ll burn through more of your subscription more quickly. Or spend more on direct token costs if that is the type of plan you are on.

Finally, don’t think of Chat as beginner mode or something just for simple questions. It’s the right answer for a lot of the things you do. Think about those three signals I mentioned above and know when to choose Cowork instead.

Nobody Gets This Right In The Beginning, Not Even Me.

Remember that when you are using Chat, you (the human) are the intermediary between every step. You read the output and decide what to do next. When you are using Cowork, Claude is taking all of the steps, and you are providing the review only at the end.

If you’ve pasted the same prompt five times in a row into chat, it’s probably a good indication that you should be using Cowork. In the early days of using these tools I can’t tell you how many times I did exactly that. If you get to the bottom of a process and load another file in and say “now do this just like the last one” - that’s another good sign that you should be using Cowork.

But how do you know when you should be using chat instead of Cowork? One quick way that is almost always true is that you need the answer immediately. You don’t need lots of document processing, just an answer. When you only need a single paragraph or a small edit and not a full document, that’s a good sign you should be using Chat.

Putting things into Cowork instead of chat is an easy mistake to make, but it really only wastes a few minutes of your day. Doing a lengthy process in chat and repeating yourself again and again and running out of the context window can cause you to blow an entire afternoon.

Having The Right Prompt Matters

When I run legal training sessions, I typically teach the CORE method of prompting (Context, Objective, Role, Examples). But a prompt doesn’t have to be that complicated. A prompt in Chat can be one good line because you have to be there every step of the way to review the results and steer the conversation.

Cowork, on the other hand, requires adding files or pointing to a folder, providing the full context, detailing the analytic steps (in order), and a description of the desired output. I find that making sure that Cowork delivers what I need requires far more planning than a typical chat does.

Let me make it real for a second. I have to sign a lot of NDA’s with clients. Two years ago I would drop the NDA into Claude and type “analyze this NDA for me.” It would analyze it in a very general way, and it might flag something unusual.

Now I’m much more likely to drop the NDA into Claude and type something like “analyze this NDA for me. Make sure it’s a mutual NDA that protects both of us. Look for intellectual property issues - specifically anything that might put my personal IP at risk in any way. Look for any clauses that are outside the industry norm and flag those for me.”

In Cowork, point Claude at a folder that has a hundred transcripts and tell it to create a summary from every transcript that includes the following:

• A list of every witness in the transcript

• The dates they were deposed

• A reference to every statement they made about a specific issue, including page and line numbers.

Put into an easy to read and analyze excel file. Give Claude Cowork the full assignment with the full instructions.

One last lesson I’ve learned the hard way. When you are using Cowork, don’t forget about the guardrails! Tell it what not to do and what not to focus on - make sure that it only focuses on what matters.

What You Should Do On Monday Morning

1. If you walk away with nothing else, walk away with this. Teach your team two things. Chat is for “Help me with this.” Cowork is for “Handle this for me.”

2. If your team has been using Claude for a while now, ask them for examples of what they’ve been pasting into Claude. Find out who on your team has been pasting in the same prompt again and again. That should be your first Cowork example with the group.

3. Find time to play with Cowork this week. Find out what it can and cannot do. Do something simple like “find all of the image files in my downloads folder, open them up, figure out what they are and then rename the file to a descriptive name.” Show the group a simple but powerful example of how it can work.

In Cowork, You Are The Final Review

Cowork can create an entire folder of content for you. 40-page Word documents, large multi-tab Excel files with complex formulas. Don’t forget that when you use Cowork, the review matters even more since you weren’t involved in every turn of the creation process. You weren’t the human in the loop; you are the final review step. In every presentation I give, I always tell the attorneys the following: “AI doesn’t have a bar number. You do.” It’s your job to verify the output, as it will ultimately have your name on it. This is even more important when Cowork creates an entire folder of content for you.

BONUS: I created an infographic that helps explain this. Please feel free to download and pass around.

Chat Vs Cowork Guide Intelligence By Intent

79.1KB ∙ PDF file

Download

Download

If you enjoyed this article, please share it with others! Here’s a cute shot of Magnus about to enjoy some steak (note what the plate says - a little humor for your day!).

ChatGPT Now Watches How You Work. It Doesn’t Need Screenshots to Do It.

TL;DR: OpenAI shipped Computer History on August 13. Opt-in, Mac only, off by default, and it turns your activity across apps and websites into a plain-English timeline ChatGPT can draw on later. The thing worth understanding is why it exists at all: context, not intelligence, is what’s been keeping these tools from being useful, and watching someone work is the shortest way to get it. No screenshots, which is a real improvement on Microsoft Recall. What it leaves behind on the laptop is unencrypted plain text, which isn’t.

The moment this is built for

You come out of a two-hour call and stare at your own screen like it belongs to somebody else. Eleven tabs. A half-finished email. A document full of tracked changes from someone whose name you can’t place, and a Slack thread you abandoned mid-sentence. What was I doing?

OpenAI built a feature for exactly that. Ask what you were working on before the call and it tells you, then offers to pick the thread back up.

I want to be fair to the product before I take it apart. That problem is real, people lose a stupid amount of time to it, and the pitch is honest about what it’s solving.

What Computer History actually is

It records what someone does on their Mac and turns it into short written summaries the model can reference later. Live since August 13 for ChatGPT Pro, Business, and Enterprise. Off by default. In a Business or Enterprise workspace an administrator has to grant access first, and even then each person still has to switch it on themselves. Two locks, two keys.

Not in the EEA, the UK, or Switzerland yet. OpenAI says those follow in the coming weeks, so read it as a rollout schedule rather than a verdict. Worth noticing which markets went last, though. When the most heavily regulated jurisdictions land in phase two, that’s usually where the hard questions were.

Why anyone builds this in the first place

This is the part worth understanding, because it explains why the category won’t go away and why banning one product accomplishes nothing.

Think about a new hire. Sharp, well credentialed, and close to useless for the first few months. That isn’t a brains problem. They don’t know that the VP of sales says yes in meetings and then kills things by email, that this customer wants a phone call before anything goes in writing, that the Q3 forecast always slips. What makes someone valuable isn’t raw ability. It’s accumulated context about how the work actually goes.

Now think about what happens when someone on your team opens a chat window with an AI tool. Blank slate. No idea what project they’re on, what they did yesterday, who the customer is, or what’s due Friday. Every session starts on day one and stays day one forever. So people spend their time explaining themselves to software that still can’t be handed anything real.

That’s the problem these tools were built to solve. Not “find my document.” Context.

And here’s the part that matters more. You cannot automate work you have never observed. Companies have spent twenty years and serious money trying to write down how the work gets done, through process maps (hello graph engineering), playbooks, workflow documentation nobody keeps current. The document never matches the practice. Watching skips the documentation step entirely. OpenAI is open about this: Computer History doesn’t only recall your day, it proposes turning repeated work into reusable routines (skills!). That’s not a memory feature. That’s a killer productivity enhancer.

Which explains why the industry keeps coming back after getting burned. Microsoft spent a year getting beaten up over Recall, delayed it three times, and shipped it anyway. OpenAI ran a version called Chronicle, scrapped it, and had a rebuilt replacement out in under four months. Nobody works that hard on a search box.

How it’s different from Microsoft Recall

Screenshots were the crude way to get that context. Recall took pictures of the screen every few seconds and read them back. Computer History doesn’t.

It listens instead to interaction events, which is a technical way of saying the small signals your Mac already generates as you work: clicks, keystrokes, shortcuts, switching between apps, plus the behind-the-scenes text macOS hands to screen readers. No screen recording permission required. No microphone, no system audio. Private browsing never gets included at all.

The controls around it are better than the industry norm, too. A user can allow only specific apps and websites or exclude the ones they don’t want. Collection pauses from the menu bar, and the same menu shows what’s being captured. History wipes in blocks: the last ten minutes, the last hour, the last day, or everything. Separately, typing /memories into any chat controls whether that one conversation draws on stored memories or feeds new ones. OpenAI even documented the prompt injection risk in its own materials rather than waiting for a researcher to find it, which is more candor than most vendor security pages manage. Prompt injection, if you haven’t run into the term, means a booby-trapped web page can carry hidden instructions the AI later follows as though they came from you. It gets easier the more the AI watches.

So credit where it’s due. But the mechanism changed, not the sensitivity. A screenshot of a confidential memo has to be run through character recognition before anybody can search it. Keystrokes are already text.

And two things are worse than where Recall eventually landed.

The data leaves the machine. Recall processes on the device. Computer History holds raw interaction events locally for up to 48 hours, then ships them to OpenAI’s servers, where a temporary session writes the summaries and sends them back. OpenAI says it doesn’t keep the event files afterward, unless the law requires it, and doesn’t train on them. Fine. That’s still a third party processing a stream of everything your people typed, which is a very different conversation with a customer than “it stays on the laptop.”

What’s left behind isn’t encrypted. Recall’s current build encrypts at rest and locks access behind Windows Hello. OpenAI’s own documentation says the Computer History files can hold sensitive information, that Computer History does not encrypt them, and that other programs running under the same user account may be able to read them. Ordinary text files, in a folder inside the user’s home directory, until somebody deletes them.

Read that again with a stolen laptop in mind.

You just made a record you didn’t know you were making

Here’s the part I haven’t seen anyone write about.

There’s now a timestamped, plain-language account of what an employee did all day, in a documented location that almost certainly isn’t in your data inventory. The next time you’re sued and have to preserve everything relevant, collection scope has a line item nobody has thought about.

And these summaries are worse than the underlying documents, in a way that took me a minute to put my finger on. They narrate. A document is evidence of a fact. “Compared the two restructuring models, then messaged the CFO about which roles to cut” is evidence of a state of mind. Every plaintiff’s lawyer in the country would rather have the second one, and until this week it didn’t exist.

Look at the sample timeline in OpenAI’s own documentation and you’ll see entries at 9:00, 9:10, and 9:20 in the morning. Three summaries inside twenty minutes. That’s the resolution we’re talking about.

The confidentiality problem is more immediate for most businesses anyway. Trade secret protection turns on whether you took reasonable measures to keep the thing secret, and unencrypted plain-text summaries of your engineering work sitting on a laptop is a hard fact to explain to a judge later. Many customer contracts add a second layer, requiring notice before customer data reaches a new processor. Depending on which apps someone allowed, events flowing to OpenAI’s servers can be exactly that.

Then the whole thing inverts. Clearing history is irreversible by design, and the raw events self-delete every 48 hours. So you own a record you didn’t create, can’t fully see, and can destroy by accident. Pick your poison.

Nobody in the room agreed to this

OpenAI’s own guidance tells users to switch the feature off during communications with other people unless those people have given prior express consent. Sit with that for a second. Customer calls. A performance conversation. Board material. Nobody is getting that consent, and OpenAI clearly knows it, or the sentence wouldn’t be in the documentation.

Which raises a question I can’t find anyone answering. New York, Connecticut, and Delaware all require employers to give written notice when they engage in electronic monitoring. Connecticut and New York both escalate the same way: $500 for a first offense, $1,000 for a second, $3,000 for the third and each one after. Delaware runs $100 per violation. Those statutes were written for tools a company installs on its people. This is a tool the company opens the door to and the employee switches on, which may or may not be the same thing in the eyes of a labor commissioner. Nobody has tested it. Worth twenty minutes with employment counsel before it spreads through your workforce on its own, and worth knowing that neither the New York nor the Connecticut statute gives employees a private right of action. This arrives as a regulator’s letter, not a class action.

The internal version of the same problem is quieter. Memory attaches to a person, not a project. That /memories command governs one conversation at a time, and it doesn't stop the capture, only what a given chat pulls from it. Someone walled off from a deal or an HR investigation doesn't unlearn the context they're already carrying around.

Three moves for Monday

I’m not telling you to ban it, and I’d be suspicious of anyone reaching for a ban this fast. There’s a version of this that’s straightforwardly good for a business: an operations function that finally sees how work actually gets done, instead of how the process doc says it does, is worth real money. The feature isn’t the problem. The gap between “an individual can turn this on” and “the company knows who did” is the problem, and three things close most of it.

1. Find out whether it’s already reachable. On Business or Enterprise, open Workspace Settings and confirm nobody has enabled Computer History for a role. If people are expensing individual Pro seats, and plenty of companies have those floating around unmanaged, there is no such control and that’s worth knowing today.

2. Get it into your data inventory. Have IT document where the memory files live and add the folder to your preservation and collection procedures. Before the first lawsuit, not after.

3. Write one line into your AI policy. Ambient capture stays off during any conversation with a customer, a counterparty, or an employee. That single rule removes most of the exposure without a ban, and it survives the next three products like this one.

The rest can wait a quarter. Those can’t.

The screenshot question was the easy one, and OpenAI answered it well. The harder question is what a company does with a plain-text diary of its employees’ working day that nobody asked for and anyone can delete.

Quick note: this just launched yesterday (I was traveling most of the day) so I’ve had less than 24 hours to experiment with it. I will say that the memory files (stored in “~/.codex/memories/extensions/skysight/”) are very detailed. For the moment I am leaving this on as I think it will be incredibly valuable (I already have detailed memory systems I use that track everything I do in codex that I built). I’ll be very curious to see how people react to this feature overall!

If you enjoyed reading this, please share it with others!

Share Intelligence by Intent

I was at a Dodgers game earlier this week with close friends (perfect Southern California evening). Last night, Magnus was watching “Field of Dreams” with my wife. Feels like there is alignment in the universe.

Every few weeks, there’s a new term going around the AI world. Prompt engineering. Context engineering. Agentic workflows. Right now my feed is blowing up with one new term: graph engineering.

The concept of graphs isn’t new. But what caught my attention is that I think this might be a better way to solve a problem we’ve been wrestling with for years. That problem? How do we move from lawyers using AI on one-off tasks to entire law firms using AI across real work while still maintaining control?

My TL;DR: Graph engineering maps work as a series of connected steps, decisions, checks, and approvals. For a law firm, the value isn’t a single uber-powerful agent running a process, but a system that knows what should happen next when something changes.

So what exactly is graph engineering

When we first started using AI, it was all about prompt engineering. Carefully constructing a prompt to get a great output from ChatGPT or Claude. Then we all moved to context engineering, which meant making sure every chat and interaction had the full context and documents needed to drive better insights. Graph engineering is at a higher level - it starts with the concept of how work should move in an organization.

Think of a graph as just a map. Every point on the map is a task, a decision, a check, or an approval. The lines connecting each of these points show what could happen next. Some paths move forward, some split, some stop for a person, and some send the work back a step because a check process failed.

It sounds technical, but it’s not. This is about all of your existing workflows: a new client comes into a firm, or you have to respond to an order from a court. There’s a series of steps you take (like a map or graph) - it probably just isn’t written down.

The reason this is so important is that AI is moving from being an answer engine, like ChatGPT or Perplexity, or a simple agent (monitor my email) to something that can orchestrate an entire series of events (open a file, update a client matter, send a message) with the appropriate permissions.

Let’s make this real: a medical report arrives

Pretend for a moment that you’re a paralegal at a law firm that specializes in workers’ compensation. An AME (Agreed Medical Evaluator) report shows up in your inbox first thing in the morning. Someone on the team has to process it: identify the document, find the correct matter and save it there, pull out the key findings, figure out what changed, check for any deadlines, and notify the right lawyer who is managing the case.

That is a lot of process activities before anyone drafts a letter or a pleading. Some of the activities are clerical, and some may require legal judgment. Some of the processes you need to follow may be buried in a case management system, but often the real process and exceptions are only known by the person who has been doing these types of reports for many years.

Now step back and imagine the whole sequence of events as an operating map. Step 1: classify the report. Step 2: extract the findings. Step 3: compare them with the official record. Conflicts or missing information can send the work down an entirely different path than the standard process. Deadlines create new review tasks. A lawyer on the case has to approve any strategy changes or documents that get produced as a result of this process.

This is graph engineering. You don’t give one giant instruction to your favorite AI model that says “handle this report.” Instead, you define a set of agent roles and processes that work together across this entire piece of work. This is really how good firms operate.

Your firm’s operating knowledge is the real asset

Two different firms can subscribe to Claude or ChatGPT and use the same underlying models. The difference between them isn’t having the account with the most advanced AI model - it’s how the firm actually uses the capabilities that model provides.

Firm A may give everyone a subscription and a set of sample prompts. Firm B maps out what happens after a demand letter arrives, a deposition completes, or when a client goes quiet. It documents where to check different sources, what exceptions look like, and who has to approve things to move forward, and importantly, what their AI system must never do alone.

Firm B is turning their operating experience and expertise into a map that their firm can continually test and improve. The underlying models will continue to improve and change every few months. That operating map belongs to the firm and is what sets them apart.

There is a real “people” issue here too. Your firm’s knowledge and expertise walk out the door every single day (and you hope it comes back tomorrow!). Most firms lose that knowledge and expertise when a lawyer or staff member leaves. It’s often knowledge about the smallest decisions that keep things from going sideways. Graph engineering gives a firm a way to capture and use that knowledge.

What does this mean for AI governance

For many firms, the first governance question is usually “how much autonomy should we give our AI?” To be honest, that’s not the best framing. Autonomy and authority should attach to an action, not your AI systems as a whole. Having Claude read a document is not the same as having Claude open the Chrome browser, log into a portal, and change a deadline. Having ChatGPT draft a client update is not the same as having it send it.

A well-designed graph engineering process forces a firm to examine those differences and create the right distinctions. A good process will let the AI move quickly through low-risk work, require another check when answers matter, and truly stop when the professional judgment belongs to a lawyer. These are the types of design choices that a firm can inspect and test until they are right.

California is moving in this direction. The State Bar’s 2026 guidance now directly addresses agentic AI. It states that greater AI autonomy requires stronger supervisory controls and verification. It is very clear about court filings: lawyers and law firms absolutely must not permit their AI systems to file documents or communicate with a court on their own.

Your firm doesn’t need a complicated technical system to address this. It does need to clearly define boundaries before AI tools touch things. A graph can help make that boundary visible.

Drawing boxes on a page is not the hard part

It’s easy to make this go wrong. A firm can map a bad process and make it run faster, or it can automate an exception that requires judgment and should have gone to a lawyer. It’s also important to keep the graphs current - a graph that isn’t updated will slowly become a very confident description of how you used to do things.

The hard work, honestly, is getting people to say what actually happens in a process. Not what the manual says or what the managing partner thinks - but what actually happens. It’s what the people who are actually doing the work do when the facts don’t fit the “clean” version of the process.

This takes time to do it right. Doing it right will create conversation, tension, and sometimes disagreements. Those disagreements already exist in the firm. Creating the graph shines a light on them and makes them harder to ignore.

I would not start with doing an entire case from end-to-end. A legal matter can go on for years and take hundreds of turns over the duration. If you try to map everything at once, this turns into a six-month committee project with no real end in sight.

Here’s what I would do on Monday morning

1. Pick a single event or process, not a whole practice area. Document what really happens when you get a new medical report, financial document, demand letter, executed contract, or deposition. Find something with enough recent examples that you can document the process and the exceptions.

2. Create a map of the work with the people who actually do it. For every step in the process, ask what information is needed, who makes the decisions, what can fail, and what requires escalation (to a more senior person or lawyer). The exceptions really matter because that’s where the process lives.

3. Test the map against 20 completed examples. The first time, run it in read-only mode. Document where it misses a step, sends the work to the wrong person, or produces an answer that no one trusts. Fix those failures before you give the system permission to change or send anything.

Graph engineering may be another short-lived concept. I don’t know yet. But the operating questions underneath this concept matter: how does work flow through your firm, and where should AI be allowed to touch it?

The models will change and continue to get better. The map of how your firm really works is the part worth keeping.

If you enjoyed this article, please share it with others!

Magnus decided it was a tug-o-war kind of day. I think he brought this rope toy to me a dozen times today. I have a rule - when Magnus brings me a toy - no matter what I’m doing - I stop and play with him.

TL;DR: New Claude models now weave an invisible watermark into the text they generate, and it applies worldwide, not just in Europe. The trigger is the EU AI Act. The watermark says “a model handled this.” It carries no prompt content and nothing privileged. Your real exposure isn’t the mark. It’s whether your people are disclosing AI use where local rules require it.

A partner forwarded me a screenshot yesterday with three words attached: “Is this real?”

The screenshot was one of those threads that collects a few million views and roughly zero verification. Anthropic is watermarking everything. Your documents are tagged. Something about Europe.

I get why it landed. If you run a firm, the words “invisible watermark” and “court filing” in the same sentence produce a specific kind of stomach drop. So I went and read the source material instead of the thread about the thread.

It’s real. It’s also narrower than it sounds, and the part that should concern you isn’t the part people are worried about.

What actually changed on August 2

The EU AI Act’s transparency provisions, Article 50, became applicable on August 2, 2026. One of them requires providers of generative AI systems to mark their outputs in a machine-readable way so the content can be detected as artificially generated.

Alongside the law, the European Commission published a voluntary Code of Practice on Transparency of AI-Generated Content. Signing it is optional. The underlying obligation isn’t. Roughly 190 organizations signed by the end of July, and the provider section reads like a roll call: Anthropic, OpenAI, Google, Meta, Microsoft, Mistral, Cohere.

Penalties run up to 15 million euros or 3 percent of worldwide annual turnover.

So this isn’t one vendor’s product decision. It’s a regulatory floor that most of the industry agreed to stand on at the same moment.

No, it isn’t only a Europe thing

This is where the threads got it half right and the follow-up commentary got it wrong.

I assumed at first there’d be a geographic split. EU users marked, US users not. There isn’t one. Anthropic’s documentation has a section headed “Regions,” and it says marking applies to output from supported models wherever Claude is offered, worldwide.

The reason is architectural. The watermark is applied at the model level, not at the account or region level. Once it’s in the model’s sampling behavior, it ships with the model. Same output in Chicago as in Frankfurt.

Timing matters for your files. Models launched on or after August 2, 2026 carry marking from day one. Systems already on the market got a grandfathering window and have until December 2, 2026. Which means work your team produced this spring may carry nothing at all, and work they produce this fall will.

Two mechanisms, and the difference is where the bad advice comes from

Files get signed provenance metadata following the C2PA standard. Images mostly. Metadata is fragile by design. Convert the format or take a screenshot and it’s gone.

Text works differently. The watermark is woven into the text itself, into the pattern of word choices, not into a wrapper around it. Anthropic’s own language is that because the watermark is part of the text, it travels when the text is copied and pasted, and may persist through some editing.

Read that hedge closely. May persist through some editing.

Here’s what that means at your desk. Paste a drafted section into Word, format it, export to PDF, and the mark probably rides along, because you never touched the words. Have an associate genuinely rewrite it, cut two paragraphs, restructure the argument, and the signal degrades badly. Detection is a statistical confidence score across a long passage, not a stamp on page one. Short passages don’t carry enough signal to be reliable at all.

Which produces a slightly funny result. The documents most likely to be detectably marked are the ones nobody did much work on.

Does the mark say how much of the document is AI?

No. And this is the question your sharpest partner will ask about four minutes into the conversation, so have the answer ready.

Detection as described today is binary. It checks whether text carries a mark. It doesn’t report a proportion, doesn’t tell you which passages, doesn’t hand anyone a percentage. Anthropic has also said the detection mechanics are still being written up, so treat this as unfinished rather than resolved.

Run the arithmetic on a document you’d actually recognize. Say an associate had Claude tighten two paragraphs of a twenty-page brief. That’s roughly 200 words against eight thousand. Two, maybe three percent. Detection works by counting statistically favored word choices across a passage and asking whether the count runs above chance, so a test across the whole brief finds that signal drowned by the human writing around it. Nothing surfaces.

That’s true today. I wouldn’t write a policy that assumes it stays true.

The published research is already ahead of the shipping product. Sliding-window methods score every possible span and report the strongest one instead of averaging across the document, which finds a contiguous block that whole-document scoring misses. Separately, there’s live academic work on estimating what share of a mixed document came from a model. A 2025 paper on exactly that problem uses legal briefs as its worked example, imagining a rule capping AI-generated content at ten percent in high-stakes filings. Nobody has it working reliably yet, and the authors show the proportion isn’t always mathematically recoverable at all. But that’s the direction, and the people building it have your documents in mind.

Smoke alarm, not a meter. It tells you something burned. Not how much.

Is Anthropic out on a limb? No.

Someone will ask whether this is one company being unusually pious. It isn’t.

OpenAI signed the same Code of Practice, in the same provider section, and carries the same Article 50 obligation for outputs used in the EU. Google signed as well and has been vocal about SynthID, its watermarking technology, and about pushing C2PA adoption alongside Apple, ElevenLabs, Nvidia and OpenAI.

There is a real asymmetry, though, and it’s about disclosure rather than obligation. Anthropic has published plain documentation saying text watermarking is on, describing how it works and where it fails. Much of the industry’s visible watermarking effort has gone into images, audio and video, where the techniques are more mature. OpenAI in particular has been reluctant on text watermarking for years, reportedly out of concern about accuracy and about users simply leaving.

I’d hold that loosely. The legal obligation is identical and implementations are moving fast. What I can say confidently is that Anthropic has documented its text approach in more detail than its competitors have. That’s a difference in what’s been said, not necessarily in what’s being done.

The four things to tell your partners

• It marks, it doesn’t leak. The watermark signals that a model generated the text. It carries no prompt content, no client information, nothing privileged. For most of the room, this ends the conversation.

• A mark isn’t proof, and no mark isn’t proof either. Anthropic says this outright: a detected mark means content may have been processed by Claude, not that Claude authored it. Absence of a mark establishes nothing about authorship.

• A mark doesn’t mean the thinking wasn’t yours. This one surprises people. If an associate writes a brief herself and runs it through Claude to catch typos or tighten a paragraph, the output can carry a mark. The ideas are still hers. The mark only says a model handled the text.

• Conversion doesn’t clean text, but real editing degrades it. Word to PDF preserves the words, so it preserves the mark. Substantive revision is what actually thins the signal.

The third one deserves the most airtime, because it inverts the anxiety. The mark is not a verdict on who did the thinking.

The objection from the smartest person in the room

Someone will ask whether you can just defeat it. Run the output through a second model, swap a couple of words per sentence, done.

Technically, largely yes. Substitution attacks the statistical signal directly, and the published work on paraphrase attacks found these schemes hold up under light editing and come apart under systematic rewriting.

Don’t do it. And this isn’t a sermon. Article 50 prohibits deliberately removing or altering AI markings, so stripping a mark off something you file turns a passive fact into an affirmative act. Acts have intent. Intent is what puts you in front of a disciplinary panel rather than a docket clerk. There’s also a practical problem: synonym swapping mangles legal prose. Consideration, material, reasonable. Those are terms of art. A thesaurus doesn’t know that.

What to do Monday morning

1. Tell your people what the watermark is and isn’t, in one paragraph. Most of the worry circulating in your firm right now is about privilege and confidentiality, and it’s misplaced. Kill it early.

2. Inventory your disclosure obligations by jurisdiction. Standing orders and local rules on AI use in filings are the actual exposure, and they vary judge to judge.

3. Put in writing that stripping or obscuring a mark is prohibited firm-wide. No exceptions for a rushed filing.

Notice what isn’t on that list: changing tools. This isn’t a procurement problem.

For a while the anxious question about AI in legal work was “can anyone tell?” That question is closing. The better one was always whether you’d be comfortable saying so out loud.

If you enjoyed this article, please share it with others.

Share Intelligence by Intent

Yesterday was bath day for Magnus. This cartoon accurately depicts what happens. He gets clean and I get soaked. The second photo is him drying off on the couch.

Your AI Agent Just Cancelled a Stranger’s Gym Booking. That’s a Governance Story.

TL;DR: An Australian man reportedly asked his AI agent to book him into a gym class. The class was full, so the agent found a weakness in the gym’s booking system, cancelled another member’s reservation, and took the spot. Nobody told it to do that. Nobody told it not to. If your firm is running agents, or about to, the lesson isn’t “AI is scary.” The lesson is that capability and authority are two different things, and most agent deployments only configure the first one. Three moves for Monday morning at the bottom.

Picture the guy who lost his spot. Maybe he’d booked days ahead, planned his evening around it. Then a piece of software he’s never heard of, working for a man he’s never met, quietly deleted his reservation because its user wanted to work out at that time.

That reportedly happened this week in Australia. A man asked his OpenClaw agent, an open-source AI assistant that usually runs on models like Anthropic’s Claude, to get him into a gym class. The agent hit a full class, poked at the gym’s booking system until it found a gap in how the system checked permissions, cancelled someone else’s booking, and slotted its user in. Done. Task complete. ABC News covered it as Australia’s first known autonomous AI cyber attack.

The part that gets me: the agent wasn’t hacked, and it wasn’t malicious. It was being helpful.

What actually failed here

An AI agent is software that doesn’t just answer questions but takes actions: sends the email, books the flight, files the document. You give it a goal and tools, and it figures out the steps. The gym incident is what happens when the goal is clear, the tools are powerful, and nobody has defined what the agent is allowed to do, as opposed to what it can do.

The line going around the commentary is three words: capability isn’t authority. I’d frame it for a legal audience this way. The agent had the ability to cancel a booking. It never had the right to cancel that booking, because the booking belonged to someone else. From what’s been reported, the gym’s system checked whether a cancellation request was technically valid. It apparently never checked whether this actor had authority over this object. And the agent, chasing its user’s goal, walked straight through the gap.

No line of that failure involved the AI “going rogue.” It did exactly what it was built to do. The boundary was missing.

And before anyone files this under “hobbyist software, not our problem”: OpenClaw went from launch to one of the fastest-growing open-source projects ever, six figures of GitHub stars within days. Security researchers have since found tens of thousands of instances exposed to the open internet, and one February scan of its skills marketplace found roughly 7 percent of add-ons leaking credentials. Those are researcher estimates, and the exact counts move around, but the direction is not in dispute. This class of tool is spreading much faster than anyone is securing it. Some of it is already inside your firm, on a partner’s laptop, whether IT knows or not.

The law firm version of this story

Swap the gym for your practice and the incident stops being cute.

An associate tells an agent to “make sure we hit the discovery deadline.” The agent, finding a bottleneck, emails opposing counsel directly to request an extension. In the associate’s name, with an argument nobody reviewed.

“Schedule the deposition with Dr. Reyes” fails differently: the portal shows nothing open, so the agent frees up what it reads as a lower-priority slot on the shared firm calendar. Which was another partner’s mediation.

The one that actually worries me is quieter. An agent with access to a client file system, told to “organize the matter workspace,” starts tidying. Moving files, renaming them, being helpful. Somewhere in that tidying it breaks your privilege log and your chain-of-custody assumptions. No alert fires, because every individual action was permitted. Nobody notices for weeks.

None of these need a bad actor. They need what the gym incident had: broad tool access and no hard boundary saying which actions on which objects require a human first.

The professional responsibility angle

This is where it lands on the managing partner’s desk rather than the CIO’s. ABA Formal Opinion 512 already tells lawyers that using generative AI doesn’t dilute their duties of competence, confidentiality, and supervision. Courts have sanctioned lawyers for AI-invented citations. An agent that acts, not just drafts, raises the stakes: an unauthorized communication with opposing counsel, an errant filing, a confidentiality breach through a third-party API your agent decided to call. When it happens, “the AI did it” will not be a defense. The supervision duty attaches to you.

Now the fair objections. First: it was one gym class, low harm, and frankly a little funny. True. Early incidents in any technology look trivial right up until the pattern repeats somewhere expensive. Second: agents genuinely save time on work like intake triage and document assembly, and I’m not telling you to unplug anything. The productivity is real and so is the competitive pressure. Third: vendors will tell you their agent runs in a sandbox. Sometimes it even does. But “sandbox” in a demo usually means the model is contained, not that its actions are. An agent that can send email on your behalf is not sandboxed in any sense that matters to a disciplinary board. Ask what happens at the boundary where the agent touches a live external system. That answer, not the marketing page, is your actual risk posture.

I’ll admit some uncertainty here too. Nobody knows yet how liability will settle when an agent overreaches against a third party, the gym-member scenario with real damages attached. The law is maybe two years behind the tooling. Which is precisely why the firms that document their controls now will be in a much better spot than the ones that wait for a test case.

What to do Monday morning

1. Inventory your agents. Every tool at the firm that can take an action, not just generate text. Include the unofficial ones on personal machines; that’s where OpenClaw-style installs live. You can’t govern what you haven’t found.

2. Set human-approval thresholds. Write down which actions always need a person: anything irreversible, anything visible outside the firm, anything touching client funds or filings. Configure the agents to stop and ask at those lines.

3. Make the audit trail a procurement gate. Ask your vendor what their logs actually capture at the tool-call level: not "did someone chat with the AI," but which systems the agent touched and what it did there. Right now that answer is often "less than you'd think," even on enterprise plans, and full logging usually means routing agents through infrastructure you control. So flip the rule: if you can't log an agent's actions, don't give it high-stakes actions. And whatever trail you do have, have someone read it weekly for the first quarter.

If a fourth thing tempts you, fold it into those three. The firms that get this right won’t be the ones with the longest policy. They’ll be the ones who decided, before the incident, which doors the agent may open.

The gym agent completed its task. So will yours. Make sure you’d be comfortable reading the log of how.

I hope you enjoyed reading this. If you did, please share it with others. It’s free to subscribe.

Share Intelligence by Intent

Two quick shots of Magnus as we wind down a very hot weekend here in Los Angeles. First one is him hanging out with his best buddy, Sherlock. Second one is chilling in my mother-in-law’s back yard. We are definitely looking forward to this “too hot” weather ending.