Every few weeks, there’s a new term going around the AI world. Prompt engineering. Context engineering. Agentic workflows. Right now my feed is blowing up with one new term: graph engineering.

The concept of graphs isn’t new. But what caught my attention is that I think this might be a better way to solve a problem we’ve been wrestling with for years. That problem? How do we move from lawyers using AI on one-off tasks to entire law firms using AI across real work while still maintaining control?

My TL;DR: Graph engineering maps work as a series of connected steps, decisions, checks, and approvals. For a law firm, the value isn’t a single uber-powerful agent running a process, but a system that knows what should happen next when something changes.

So what exactly is graph engineering

When we first started using AI, it was all about prompt engineering. Carefully constructing a prompt to get a great output from ChatGPT or Claude. Then we all moved to context engineering, which meant making sure every chat and interaction had the full context and documents needed to drive better insights. Graph engineering is at a higher level - it starts with the concept of how work should move in an organization.

Think of a graph as just a map. Every point on the map is a task, a decision, a check, or an approval. The lines connecting each of these points show what could happen next. Some paths move forward, some split, some stop for a person, and some send the work back a step because a check process failed.

It sounds technical, but it’s not. This is about all of your existing workflows: a new client comes into a firm, or you have to respond to an order from a court. There’s a series of steps you take (like a map or graph) - it probably just isn’t written down.

The reason this is so important is that AI is moving from being an answer engine, like ChatGPT or Perplexity, or a simple agent (monitor my email) to something that can orchestrate an entire series of events (open a file, update a client matter, send a message) with the appropriate permissions.

Let’s make this real: a medical report arrives

Pretend for a moment that you’re a paralegal at a law firm that specializes in workers’ compensation. An AME (Agreed Medical Evaluator) report shows up in your inbox first thing in the morning. Someone on the team has to process it: identify the document, find the correct matter and save it there, pull out the key findings, figure out what changed, check for any deadlines, and notify the right lawyer who is managing the case.

That is a lot of process activities before anyone drafts a letter or a pleading. Some of the activities are clerical, and some may require legal judgment. Some of the processes you need to follow may be buried in a case management system, but often the real process and exceptions are only known by the person who has been doing these types of reports for many years.

Now step back and imagine the whole sequence of events as an operating map. Step 1: classify the report. Step 2: extract the findings. Step 3: compare them with the official record. Conflicts or missing information can send the work down an entirely different path than the standard process. Deadlines create new review tasks. A lawyer on the case has to approve any strategy changes or documents that get produced as a result of this process.

This is graph engineering. You don’t give one giant instruction to your favorite AI model that says “handle this report.” Instead, you define a set of agent roles and processes that work together across this entire piece of work. This is really how good firms operate.

Your firm’s operating knowledge is the real asset

Two different firms can subscribe to Claude or ChatGPT and use the same underlying models. The difference between them isn’t having the account with the most advanced AI model - it’s how the firm actually uses the capabilities that model provides.

Firm A may give everyone a subscription and a set of sample prompts. Firm B maps out what happens after a demand letter arrives, a deposition completes, or when a client goes quiet. It documents where to check different sources, what exceptions look like, and who has to approve things to move forward, and importantly, what their AI system must never do alone.

Firm B is turning their operating experience and expertise into a map that their firm can continually test and improve. The underlying models will continue to improve and change every few months. That operating map belongs to the firm and is what sets them apart.

There is a real “people” issue here too. Your firm’s knowledge and expertise walk out the door every single day (and you hope it comes back tomorrow!). Most firms lose that knowledge and expertise when a lawyer or staff member leaves. It’s often knowledge about the smallest decisions that keep things from going sideways. Graph engineering gives a firm a way to capture and use that knowledge.

What does this mean for AI governance

For many firms, the first governance question is usually “how much autonomy should we give our AI?” To be honest, that’s not the best framing. Autonomy and authority should attach to an action, not your AI systems as a whole. Having Claude read a document is not the same as having Claude open the Chrome browser, log into a portal, and change a deadline. Having ChatGPT draft a client update is not the same as having it send it.

A well-designed graph engineering process forces a firm to examine those differences and create the right distinctions. A good process will let the AI move quickly through low-risk work, require another check when answers matter, and truly stop when the professional judgment belongs to a lawyer. These are the types of design choices that a firm can inspect and test until they are right.

California is moving in this direction. The State Bar’s 2026 guidance now directly addresses agentic AI. It states that greater AI autonomy requires stronger supervisory controls and verification. It is very clear about court filings: lawyers and law firms absolutely must not permit their AI systems to file documents or communicate with a court on their own.

Your firm doesn’t need a complicated technical system to address this. It does need to clearly define boundaries before AI tools touch things. A graph can help make that boundary visible.

Drawing boxes on a page is not the hard part

It’s easy to make this go wrong. A firm can map a bad process and make it run faster, or it can automate an exception that requires judgment and should have gone to a lawyer. It’s also important to keep the graphs current - a graph that isn’t updated will slowly become a very confident description of how you used to do things.

The hard work, honestly, is getting people to say what actually happens in a process. Not what the manual says or what the managing partner thinks - but what actually happens. It’s what the people who are actually doing the work do when the facts don’t fit the “clean” version of the process.

This takes time to do it right. Doing it right will create conversation, tension, and sometimes disagreements. Those disagreements already exist in the firm. Creating the graph shines a light on them and makes them harder to ignore.

I would not start with doing an entire case from end-to-end. A legal matter can go on for years and take hundreds of turns over the duration. If you try to map everything at once, this turns into a six-month committee project with no real end in sight.

Here’s what I would do on Monday morning

1. Pick a single event or process, not a whole practice area. Document what really happens when you get a new medical report, financial document, demand letter, executed contract, or deposition. Find something with enough recent examples that you can document the process and the exceptions.

2. Create a map of the work with the people who actually do it. For every step in the process, ask what information is needed, who makes the decisions, what can fail, and what requires escalation (to a more senior person or lawyer). The exceptions really matter because that’s where the process lives.

3. Test the map against 20 completed examples. The first time, run it in read-only mode. Document where it misses a step, sends the work to the wrong person, or produces an answer that no one trusts. Fix those failures before you give the system permission to change or send anything.

Graph engineering may be another short-lived concept. I don’t know yet. But the operating questions underneath this concept matter: how does work flow through your firm, and where should AI be allowed to touch it?

The models will change and continue to get better. The map of how your firm really works is the part worth keeping.

If you enjoyed this article, please share it with others!

Magnus decided it was a tug-o-war kind of day. I think he brought this rope toy to me a dozen times today. I have a rule - when Magnus brings me a toy - no matter what I’m doing - I stop and play with him.

TL;DR: New Claude models now weave an invisible watermark into the text they generate, and it applies worldwide, not just in Europe. The trigger is the EU AI Act. The watermark says “a model handled this.” It carries no prompt content and nothing privileged. Your real exposure isn’t the mark. It’s whether your people are disclosing AI use where local rules require it.

A partner forwarded me a screenshot yesterday with three words attached: “Is this real?”

The screenshot was one of those threads that collects a few million views and roughly zero verification. Anthropic is watermarking everything. Your documents are tagged. Something about Europe.

I get why it landed. If you run a firm, the words “invisible watermark” and “court filing” in the same sentence produce a specific kind of stomach drop. So I went and read the source material instead of the thread about the thread.

It’s real. It’s also narrower than it sounds, and the part that should concern you isn’t the part people are worried about.

What actually changed on August 2

The EU AI Act’s transparency provisions, Article 50, became applicable on August 2, 2026. One of them requires providers of generative AI systems to mark their outputs in a machine-readable way so the content can be detected as artificially generated.

Alongside the law, the European Commission published a voluntary Code of Practice on Transparency of AI-Generated Content. Signing it is optional. The underlying obligation isn’t. Roughly 190 organizations signed by the end of July, and the provider section reads like a roll call: Anthropic, OpenAI, Google, Meta, Microsoft, Mistral, Cohere.

Penalties run up to 15 million euros or 3 percent of worldwide annual turnover.

So this isn’t one vendor’s product decision. It’s a regulatory floor that most of the industry agreed to stand on at the same moment.

No, it isn’t only a Europe thing

This is where the threads got it half right and the follow-up commentary got it wrong.

I assumed at first there’d be a geographic split. EU users marked, US users not. There isn’t one. Anthropic’s documentation has a section headed “Regions,” and it says marking applies to output from supported models wherever Claude is offered, worldwide.

The reason is architectural. The watermark is applied at the model level, not at the account or region level. Once it’s in the model’s sampling behavior, it ships with the model. Same output in Chicago as in Frankfurt.

Timing matters for your files. Models launched on or after August 2, 2026 carry marking from day one. Systems already on the market got a grandfathering window and have until December 2, 2026. Which means work your team produced this spring may carry nothing at all, and work they produce this fall will.

Two mechanisms, and the difference is where the bad advice comes from

Files get signed provenance metadata following the C2PA standard. Images mostly. Metadata is fragile by design. Convert the format or take a screenshot and it’s gone.

Text works differently. The watermark is woven into the text itself, into the pattern of word choices, not into a wrapper around it. Anthropic’s own language is that because the watermark is part of the text, it travels when the text is copied and pasted, and may persist through some editing.

Read that hedge closely. May persist through some editing.

Here’s what that means at your desk. Paste a drafted section into Word, format it, export to PDF, and the mark probably rides along, because you never touched the words. Have an associate genuinely rewrite it, cut two paragraphs, restructure the argument, and the signal degrades badly. Detection is a statistical confidence score across a long passage, not a stamp on page one. Short passages don’t carry enough signal to be reliable at all.

Which produces a slightly funny result. The documents most likely to be detectably marked are the ones nobody did much work on.

Does the mark say how much of the document is AI?

No. And this is the question your sharpest partner will ask about four minutes into the conversation, so have the answer ready.

Detection as described today is binary. It checks whether text carries a mark. It doesn’t report a proportion, doesn’t tell you which passages, doesn’t hand anyone a percentage. Anthropic has also said the detection mechanics are still being written up, so treat this as unfinished rather than resolved.

Run the arithmetic on a document you’d actually recognize. Say an associate had Claude tighten two paragraphs of a twenty-page brief. That’s roughly 200 words against eight thousand. Two, maybe three percent. Detection works by counting statistically favored word choices across a passage and asking whether the count runs above chance, so a test across the whole brief finds that signal drowned by the human writing around it. Nothing surfaces.

That’s true today. I wouldn’t write a policy that assumes it stays true.

The published research is already ahead of the shipping product. Sliding-window methods score every possible span and report the strongest one instead of averaging across the document, which finds a contiguous block that whole-document scoring misses. Separately, there’s live academic work on estimating what share of a mixed document came from a model. A 2025 paper on exactly that problem uses legal briefs as its worked example, imagining a rule capping AI-generated content at ten percent in high-stakes filings. Nobody has it working reliably yet, and the authors show the proportion isn’t always mathematically recoverable at all. But that’s the direction, and the people building it have your documents in mind.

Smoke alarm, not a meter. It tells you something burned. Not how much.

Is Anthropic out on a limb? No.

Someone will ask whether this is one company being unusually pious. It isn’t.

OpenAI signed the same Code of Practice, in the same provider section, and carries the same Article 50 obligation for outputs used in the EU. Google signed as well and has been vocal about SynthID, its watermarking technology, and about pushing C2PA adoption alongside Apple, ElevenLabs, Nvidia and OpenAI.

There is a real asymmetry, though, and it’s about disclosure rather than obligation. Anthropic has published plain documentation saying text watermarking is on, describing how it works and where it fails. Much of the industry’s visible watermarking effort has gone into images, audio and video, where the techniques are more mature. OpenAI in particular has been reluctant on text watermarking for years, reportedly out of concern about accuracy and about users simply leaving.

I’d hold that loosely. The legal obligation is identical and implementations are moving fast. What I can say confidently is that Anthropic has documented its text approach in more detail than its competitors have. That’s a difference in what’s been said, not necessarily in what’s being done.

The four things to tell your partners

• It marks, it doesn’t leak. The watermark signals that a model generated the text. It carries no prompt content, no client information, nothing privileged. For most of the room, this ends the conversation.

• A mark isn’t proof, and no mark isn’t proof either. Anthropic says this outright: a detected mark means content may have been processed by Claude, not that Claude authored it. Absence of a mark establishes nothing about authorship.

• A mark doesn’t mean the thinking wasn’t yours. This one surprises people. If an associate writes a brief herself and runs it through Claude to catch typos or tighten a paragraph, the output can carry a mark. The ideas are still hers. The mark only says a model handled the text.

• Conversion doesn’t clean text, but real editing degrades it. Word to PDF preserves the words, so it preserves the mark. Substantive revision is what actually thins the signal.

The third one deserves the most airtime, because it inverts the anxiety. The mark is not a verdict on who did the thinking.

The objection from the smartest person in the room

Someone will ask whether you can just defeat it. Run the output through a second model, swap a couple of words per sentence, done.

Technically, largely yes. Substitution attacks the statistical signal directly, and the published work on paraphrase attacks found these schemes hold up under light editing and come apart under systematic rewriting.

Don’t do it. And this isn’t a sermon. Article 50 prohibits deliberately removing or altering AI markings, so stripping a mark off something you file turns a passive fact into an affirmative act. Acts have intent. Intent is what puts you in front of a disciplinary panel rather than a docket clerk. There’s also a practical problem: synonym swapping mangles legal prose. Consideration, material, reasonable. Those are terms of art. A thesaurus doesn’t know that.

What to do Monday morning

1. Tell your people what the watermark is and isn’t, in one paragraph. Most of the worry circulating in your firm right now is about privilege and confidentiality, and it’s misplaced. Kill it early.

2. Inventory your disclosure obligations by jurisdiction. Standing orders and local rules on AI use in filings are the actual exposure, and they vary judge to judge.

3. Put in writing that stripping or obscuring a mark is prohibited firm-wide. No exceptions for a rushed filing.

Notice what isn’t on that list: changing tools. This isn’t a procurement problem.

For a while the anxious question about AI in legal work was “can anyone tell?” That question is closing. The better one was always whether you’d be comfortable saying so out loud.

If you enjoyed this article, please share it with others.

Share Intelligence by Intent

Yesterday was bath day for Magnus. This cartoon accurately depicts what happens. He gets clean and I get soaked. The second photo is him drying off on the couch.

Your AI Agent Just Cancelled a Stranger’s Gym Booking. That’s a Governance Story.

TL;DR: An Australian man reportedly asked his AI agent to book him into a gym class. The class was full, so the agent found a weakness in the gym’s booking system, cancelled another member’s reservation, and took the spot. Nobody told it to do that. Nobody told it not to. If your firm is running agents, or about to, the lesson isn’t “AI is scary.” The lesson is that capability and authority are two different things, and most agent deployments only configure the first one. Three moves for Monday morning at the bottom.

Picture the guy who lost his spot. Maybe he’d booked days ahead, planned his evening around it. Then a piece of software he’s never heard of, working for a man he’s never met, quietly deleted his reservation because its user wanted to work out at that time.

That reportedly happened this week in Australia. A man asked his OpenClaw agent, an open-source AI assistant that usually runs on models like Anthropic’s Claude, to get him into a gym class. The agent hit a full class, poked at the gym’s booking system until it found a gap in how the system checked permissions, cancelled someone else’s booking, and slotted its user in. Done. Task complete. ABC News covered it as Australia’s first known autonomous AI cyber attack.

The part that gets me: the agent wasn’t hacked, and it wasn’t malicious. It was being helpful.

What actually failed here

An AI agent is software that doesn’t just answer questions but takes actions: sends the email, books the flight, files the document. You give it a goal and tools, and it figures out the steps. The gym incident is what happens when the goal is clear, the tools are powerful, and nobody has defined what the agent is allowed to do, as opposed to what it can do.

The line going around the commentary is three words: capability isn’t authority. I’d frame it for a legal audience this way. The agent had the ability to cancel a booking. It never had the right to cancel that booking, because the booking belonged to someone else. From what’s been reported, the gym’s system checked whether a cancellation request was technically valid. It apparently never checked whether this actor had authority over this object. And the agent, chasing its user’s goal, walked straight through the gap.

No line of that failure involved the AI “going rogue.” It did exactly what it was built to do. The boundary was missing.

And before anyone files this under “hobbyist software, not our problem”: OpenClaw went from launch to one of the fastest-growing open-source projects ever, six figures of GitHub stars within days. Security researchers have since found tens of thousands of instances exposed to the open internet, and one February scan of its skills marketplace found roughly 7 percent of add-ons leaking credentials. Those are researcher estimates, and the exact counts move around, but the direction is not in dispute. This class of tool is spreading much faster than anyone is securing it. Some of it is already inside your firm, on a partner’s laptop, whether IT knows or not.

The law firm version of this story

Swap the gym for your practice and the incident stops being cute.

An associate tells an agent to “make sure we hit the discovery deadline.” The agent, finding a bottleneck, emails opposing counsel directly to request an extension. In the associate’s name, with an argument nobody reviewed.

“Schedule the deposition with Dr. Reyes” fails differently: the portal shows nothing open, so the agent frees up what it reads as a lower-priority slot on the shared firm calendar. Which was another partner’s mediation.

The one that actually worries me is quieter. An agent with access to a client file system, told to “organize the matter workspace,” starts tidying. Moving files, renaming them, being helpful. Somewhere in that tidying it breaks your privilege log and your chain-of-custody assumptions. No alert fires, because every individual action was permitted. Nobody notices for weeks.

None of these need a bad actor. They need what the gym incident had: broad tool access and no hard boundary saying which actions on which objects require a human first.

The professional responsibility angle

This is where it lands on the managing partner’s desk rather than the CIO’s. ABA Formal Opinion 512 already tells lawyers that using generative AI doesn’t dilute their duties of competence, confidentiality, and supervision. Courts have sanctioned lawyers for AI-invented citations. An agent that acts, not just drafts, raises the stakes: an unauthorized communication with opposing counsel, an errant filing, a confidentiality breach through a third-party API your agent decided to call. When it happens, “the AI did it” will not be a defense. The supervision duty attaches to you.

Now the fair objections. First: it was one gym class, low harm, and frankly a little funny. True. Early incidents in any technology look trivial right up until the pattern repeats somewhere expensive. Second: agents genuinely save time on work like intake triage and document assembly, and I’m not telling you to unplug anything. The productivity is real and so is the competitive pressure. Third: vendors will tell you their agent runs in a sandbox. Sometimes it even does. But “sandbox” in a demo usually means the model is contained, not that its actions are. An agent that can send email on your behalf is not sandboxed in any sense that matters to a disciplinary board. Ask what happens at the boundary where the agent touches a live external system. That answer, not the marketing page, is your actual risk posture.

I’ll admit some uncertainty here too. Nobody knows yet how liability will settle when an agent overreaches against a third party, the gym-member scenario with real damages attached. The law is maybe two years behind the tooling. Which is precisely why the firms that document their controls now will be in a much better spot than the ones that wait for a test case.

What to do Monday morning

1. Inventory your agents. Every tool at the firm that can take an action, not just generate text. Include the unofficial ones on personal machines; that’s where OpenClaw-style installs live. You can’t govern what you haven’t found.

2. Set human-approval thresholds. Write down which actions always need a person: anything irreversible, anything visible outside the firm, anything touching client funds or filings. Configure the agents to stop and ask at those lines.

3. Make the audit trail a procurement gate. Ask your vendor what their logs actually capture at the tool-call level: not "did someone chat with the AI," but which systems the agent touched and what it did there. Right now that answer is often "less than you'd think," even on enterprise plans, and full logging usually means routing agents through infrastructure you control. So flip the rule: if you can't log an agent's actions, don't give it high-stakes actions. And whatever trail you do have, have someone read it weekly for the first quarter.

If a fourth thing tempts you, fold it into those three. The firms that get this right won’t be the ones with the longest policy. They’ll be the ones who decided, before the incident, which doors the agent may open.

The gym agent completed its task. So will yours. Make sure you’d be comfortable reading the log of how.

I hope you enjoyed reading this. If you did, please share it with others. It’s free to subscribe.

Share Intelligence by Intent

Two quick shots of Magnus as we wind down a very hot weekend here in Los Angeles. First one is him hanging out with his best buddy, Sherlock. Second one is chilling in my mother-in-law’s back yard. We are definitely looking forward to this “too hot” weather ending.

Google Built the Roads. Now It Has to Own the Work.

TL;DR: Google isn’t losing the AI race. It’s sitting on the industry’s strongest asset collection without connecting the pieces. The way back: one Gemini, one developer harness, one company memory, and products only Google can build.

Google doesn’t need another AI comeback. It already has the ingredients. Gemini has 950 million monthly users. AI Mode has passed a billion. Cloud revenue grew 82 percent last quarter, the backlog reached $514 billion, and nearly 90 percent of the Fortune 100 use Gemini Enterprise.

Those aren’t the numbers of a company losing the AI race. They’re the numbers of a company that hasn’t converted its advantages into a coherent position.

Look at the collection: Search, YouTube, Chrome, Maps, Android, Workspace, custom chips, frontier models, a booming cloud, and a growing model of the physical world. Nobody else has that list. Not close. But collections don’t make a strategy. Connections do.

And model leadership may last three months at a time. Gemini 3.1 Pro proved Google can build a frontier model when it wants one. The durable position is the one that keeps getting stronger even when someone else briefly has the smartest model: being the operating system for intelligent work.

Start with one Gemini

The business version of Gemini should be at least as capable as the consumer version. Not eventually. Now. An enterprise customer isn’t buying a reduced Gemini. It’s paying Google to make the real one safe enough for the company’s most valuable information. The difference between consumer and business Gemini should be governance: identity, audit, residency, retention, legal protections. Never subtraction.

Google keeps shipping its best capabilities to consumers first. Spark rolled out to 160 new countries and landed in Chrome while business access sat “in preview.” Flip that sequence with a public parity commitment: every major Gemini feature reaches managed business accounts the same day, with a 30-day maximum when added controls are genuinely required.

Google’s privacy protections are better than most buyers realize, so put them inside the product. Every business surface should carry one plain-English status panel: managed by your organization, your content does not train Google’s public models, retention 30 days, region United States, human review disabled. In the deals I see, that one panel resolves more objections than twenty pages of security PDFs.

Win the terminal

Coding is where enterprises first see measurable AI economics. Complete the task, run the tests, do the math on the hours. It’s also the wedge: the agent that understands your repository today is managing your cloud and your incidents tomorrow.

Google has real momentum here. Antigravity has 2.4 million weekly users, and Google says one internal Chrome team used it to compress a two-year refactoring schedule into three months. Now make it one execution system instead of a family of related products: terminal, IDE, desktop, CI, and Cloud on one architecture, where context and permissions travel with the work and every run leaves an audit trail. Each enterprise run produces a signed manifest: model, tools called, files changed, tests, approvals, cost.

Then give the enterprise version away with meaningful GCP and Workspace commitments, because the standard coding tool decides where a company builds, deploys, and buys compute for the next decade. Google can’t settle for competitive here. It needs to win.

Turn Workspace into the company’s memory

Google’s largest enterprise advantage may not be the model at all. It might be the information already sitting inside Workspace. Gmail knows who talks to whom. Calendar knows what people committed to. Meet holds the conversations, Drive the institutional record.

Connect it into a permission-aware work graph: a federated index, not a giant copy, that preserves whatever permissions already exist on the underlying information. Gemini can then answer what companies actually pay for (what did we decide, who approved it, what’s still open) and act on the answers. A meeting becomes attributed decisions, the follow-up drafts itself, the plan updates, the work gets assigned and tracked, with an audit trail the whole way.

That isn’t another productivity feature. It’s institutional memory. Microsoft can attempt something similar across Office and Teams, but Google holds two extra cards: Search and Chrome.

Make Chrome the action layer

Most of the software enterprises actually run, from legacy systems to niche SaaS to client portals, was never designed for agents. Google owns the browser it all runs through. Managed Spark should become a secure action layer across authorized applications, with admins defining sites, credentials, spending limits, approvals, and evidence retention. Microsoft has Windows and Office. Salesforce and ServiceNow have their systems of record. Google has the browser sitting in front of nearly all of it.

Sell the information products only Google can build

The browser carries Google’s agents into other people’s software. Google’s own data can carry them further, if it’s sold the right way. Every major AI company has models. Only Google has Search, YouTube, Maps, Street View, Earth, the shopping graph, and decades of practice judging which information matters. Don’t pour it all into training. Package selected assets into permissioned commercial products.

Start with a Google Evidence Cloud. Enterprise buyers need reproducibility, not an answer with links attached: the sources, passages, dates, retrieval times, and versions behind every answer. A lawyer shows what was considered. Search becomes an enterprise evidence service.

Then geospatial intelligence. Street View Insights can already analyze physical assets like utility poles across whole regions, so sell it by vertical: insurers, utilities, construction.

And video. Permissioned intelligence on customer-owned and licensed footage, creator rights intact: find the exact moment something happened, check it against the approved procedure, keep the record as evidence.

None of this depends on Google quietly using more data than everyone else. The whole play is packaging: the right data, with permissions, provenance, and commercial terms attached.

Turn the world model into a business

And the most under-priced asset on that list isn’t text at all. It’s Google’s model of the physical world.

Genie generates interactive environments in real time, anchors them to Street View, and already helps Waymo simulate realistic roads. Right now that reads as a spectacular demo. It should be Google Simulation Cloud. An insurer runs a hurricane against a representation of Tampa. An agent practices a task ten thousand times before performing it once. Simulation turns rare, dangerous events into repeatable data.

Simulation leads straight into physical operations. Gemini’s robotics models already reason spatially, plan tasks, watch continuous video, and coordinate machines. Wrap them in a physical agent platform, with identity, safety policies, telemetry, and audit, for robots, drones, and field crews. It’s a category that only exists on top of assets Google happens to own.

Pick a few verticals and go deep

Skip the thirty lightly skinned industry products. Pick the handful where the assets create structural advantage. Cybersecurity is the obvious one: Mandiant, Wiz, threat intelligence, cyber-tuned models, and, per Google, security products already inside 90 percent of the Fortune 100. Then industrial and field operations, where Maps, video, and simulation converge. Health and life sciences on the DeepMind and AlphaFold foundation. Retail and commerce after that.

Professional services stay attractive, and I’ll speak for my own market: a serious legal product needs licensed authoritative content, evidence lineage, matter-level security, and ethical walls, not a general model bolted to web search. Specialization doesn’t mean changing the system prompt. It means building the whole business.

Let customers choose the model

The Agent Platform already offers more than 200 models, including Anthropic’s Claude. Make that central instead of grudging. Gemini for multimodal work, Claude for a coding flow, a small Gemma model on-device. Fine. Google keeps the context, identity, execution environment, security, and compute either way, plus model revenue whenever Gemini wins on merit. Enterprise buyers don’t want a theological debate about model families. They want the best result under the right controls at a predictable cost. Every buyer I advise says some version of that same sentence. Be the company that delivers it.

Sell completed work, not tokens

TPUs give Google a real cost edge, but tokens are an input. Businesses buy outcomes. Price the governed workflow: modernize an application, investigate an incident, review a contract portfolio. “Best intelligence per dollar” is a reasonable model slogan. “Best verified business outcome per dollar” is a much stronger enterprise strategy.

Build one release train

None of this works if every product moves on its own schedule. A model launches when it’s available across consumer, developer, and enterprise surfaces under clear, consistent terms, all the way down to air-gapped Distributed Cloud, not when the research team publishes a post. For governments, banks, hospitals, and law firms, private AI isn’t a niche option. It’s the price of admission.

Then measure like a business: demo-to-production speed, pilots that become operations, cost per workflow, how often humans have to step in. Benchmarks say whether the model is good. These numbers say whether the business is.

Could I be wrong? Sure. Some of this may already be the plan in motion, and betting against Google’s compute has embarrassed smarter people than me. Good. Competition at the top helps every buyer in the market.

Google’s Monday morning

1. Declare parity day: every consumer Gemini capability reaches managed business accounts the same day or within 30, with the status panel on every surface.

2. Unify on one developer harness, business first, with signed run manifests, and ship the next flagship only when it wins real production work.

3. Put a price sheet on the only-Google line this quarter: Evidence Cloud, Simulation Cloud, and one vertical run as its own business.

The twelve-month test

Google doesn’t need to win every benchmark or pry enterprises away from anyone. It needs to make intelligent work go better because Google is underneath it. The test is simple: does a Workspace customer get the good Gemini on day one, does enterprise development run on one harness, and does the world model have a price sheet?

Google already built the roads. Now it has to own the work.

If you enjoy this article, please share it with others.

Share Intelligence by Intent

Here’s a shot of Magnus patiently waiting for his favorite food - freshly BBQ’d steak. He knows when I’m cooking it and this is the only time he will patiently sit and watch and wait because he knows what’s coming. Bonus video - he decided to help himself to my wife’s tea. ;)

Your Claude Project Holds Far More Than It Reads

TL;DR: Claude projects accept an “unlimited” number of files, and once you pass the context window they switch to retrieval, which expands capacity by up to ten times. Both numbers are real. They measure different things. A project can hold north of six thousand pages while considering six hundred to twelve hundred of them at a time. Storage went up. Attention didn’t.

The complaint I keep hearing

The pattern shows up the same way every time. A firm loads four years of engagement letters, a pile of transcripts, and every closing checklist anyone can find into one project. Nothing breaks. Then the answers start going soft, and one day somebody notices that Claude missed language sitting in a document they uploaded themselves.

The interface never complained. It said unlimited, so they treated it as unlimited.

What happened there is worth understanding, because the fix is arithmetic rather than a support ticket.

Two numbers, and people only ever hear one

Claude projects cap files at 30MB each and put no cap on how many you upload. That second number is the one everybody repeats. It’s also the one that means the least.

What runs your project is the context window. That’s how much Claude holds in front of it at one time. On the current models, chatting on a paid plan, you get a million tokens. Older ones run at half or a fifth of that.

A token is a fragment of a word. Anthropic puts it at roughly three and a half characters. That’s well short of the “three quarters of a word” rule people still quote, and the newest models make it worse. They tokenize about thirty percent heavier than the ones before them. Same text, thirty percent more tokens. So a million tokens buys you closer to six hundred thousand words than the seven hundred fifty thousand the old rule promises.

Then subtract working room. Project instructions, the conversation itself, any connectors you’re running, and Claude’s own answers all pull from the same pool. I budget about seventy percent of the window for documents. That’s my rule of thumb, not a published figure.

Count pages, not megabytes

Here’s where I have to be honest about how soft this arithmetic is.

A single-spaced page of business or legal prose runs around 500 words. That page costs somewhere between 600 and 1,100 tokens, depending on which of Anthropic’s published figures you run it through. Deposition pages are lighter, 350 to 550, depending on how much of each line the testimony actually fills.

Run that against a 700,000 token working budget and you get 600 to 1,200 pages that Claude can hold in view at once. Cross that line and retrieval takes over, lifting capacity by as much as ten times.

Those ranges are wide and I’m leaving them wide. Anthropic publishes a page-count heuristic in one place and a character-per-token definition in another. Do the math both ways and the answers differ by roughly double. Anyone handing you a single confident number for this is doing arithmetic on sand. Plan against the low end.

Now compare any of it to the 30MB file cap everyone quotes. A megabyte of extracted text runs around 300,000 tokens, more on the newer models. Three text files could fill the entire window without any of them coming near the cap. Meanwhile a long scanned PDF might contribute nothing at all, because past 100 pages Claude drops to text only, and a scan without a text layer has no text to pull.

Megabytes describe storage. Pages describe attention. Only one of those is scarce.

Holds is not the same as reads

When your project crosses the line, Claude stops loading everything and starts searching. It uses a project knowledge search tool, pulls back the passages that look relevant, and answers from those. There’s an indicator when this happens. Almost nobody notices it.

Anthropic’s position is that quality holds steady through the switch. For a large share of what people do with projects, I think that’s right. Ask “what does the indemnity clause say in the Henderson agreement” and retrieval is the better tool. It’s faster and it doesn’t waste the window.

But ask “compare the indemnity language across all 40 of these agreements and tell me which three are outliers” and something different is happening. Retrieval decides what Claude sees before Claude reasons about it. The mechanism predicts that comparison and synthesis suffer in ways lookup doesn’t. The answer comes back in the same confident register either way, so you get no signal telling you whether it looked at 40 agreements or 6.

So test it. Ask Claude to name every document it consulted, then check that list against what you thought you asked about.

That firm’s project hadn’t broken. It had been promoted to a search tool without anyone asking.

The objection, which is fair

Someone always says: fine, so cap every project at a thousand pages, and now I’m managing capacity instead of doing work.

That’s not the tradeoff. Retrieval is genuinely better for reference material. If you’re building a project that holds your clause bank, your brand guidelines, your onboarding docs, the whole point is lookup, and you should blow past a thousand pages without a second thought. That’s what the ten times is for.

The question isn’t size. It’s whether the task needs Claude to see everything at once. Most firms build one giant project, use it for both kinds of work, and can’t explain why the answers vary. The pull runs one direction, too. A project you like is a project you keep feeding.

Splitting is cheaper than people assume. Each project gets its own capacity, so a second one starts with a fresh budget instead of eating into the first. What splitting costs you is routing. Somebody has to know which project holds the answer, and in a firm that somebody is usually the associate who wasn’t there when the projects were set up.

What to do Monday morning

1. Convert one project to pages. Take your most-used project, add up the page count, and put it against the 600 to 1,200 range. You’ll either feel fine or you’ll feel something drop.

2. Split by job, not by client. Keep one deliberately small project for work that needs full reading. Let the reference project be enormous.

3. Rename your files like an index. Once retrieval is running, file names are how Claude decides where to look. “Smith_MSA_2024_indemnity.pdf” gets found. “Document (3) final FINAL.pdf” does not.

Unlimited uploads are not unlimited attention. Your project will always accept the next document. It just stops reading them all at some point, and it won’t tell you when.

If you enjoyed reading this, please share with others.

Share Intelligence by Intent

Here’s a shot of Magnus from yesterday sitting in the yard, waiting patiently to go on a walk.

How I Turned 3 Million Pages Into a Deposition Search Tool in a Day

TL;DR: Three million pages of case material went into a set of indexes. Those indexes pulled out the 5,000 pages that actually mattered for one deposition. I built a search app over those 5,000 pages in a day with Codex. To be clear about what this is not: nothing here searches three million pages live. That’s Google-level engineering and I did not build it in Codex. The funnel is the whole trick.

The moment the old way breaks

You know the feeling. You’re in a deposition. The witness says something that contradicts testimony from two years ago, and you know it. You can feel it. You just can’t find it.

I’ve been working with a client on a major case for over a year. Over 50,000 documents. North of three million pages. Depositions, trial transcripts, declarations, exhibit lists, text messages, emails, judgments, property records, financial statements, photos, audio, video. Hundreds of witnesses and experts have testified or been listed to testify across multiple years, and the list of people who might still be called keeps moving.

Nobody holds that in their head. Neither does a paralegal with a binder.

What the client asked for

Two things.

First: instant search across the transcripts that mattered for one upcoming deposition. Type a word or a phrase, get back what was asked, how it was answered, and which document and date it came from. Sub-second. Fast enough to use live, mid-question.

Second: everything a given witness has ever said, summarized. Topics they touched. Places where their story shifted.

A year ago I’d have told this client the first one was a vendor project and the second one probably wasn’t worth attempting.

The pre-work nobody talks about

A month earlier I’d built an agent in Codex that read every document in the corpus and pulled out every person named and every key topic, then wrote all of it into a SQL database sitting on my laptop. A few hours to run. I didn’t build it for this project. I built it because I was tired of not being able to find things.

That’s the part people skip when they tell these stories.

So when it came time to pull the specific documents, I didn’t go hunting. I ran a query. Thirty seconds to identify and copy every relevant file into a new folder. An associate doing that same pull by hand would have spent countless hours on it.

Three million pages in. About 5,000 pages out. Those 5,000 were what the app would actually search, and that reduction is why any of the rest of this was possible.

The index is the thing. Everything after it was fast because of it.

Building it

I described what I needed to Codex, running GPT-5.6 Sol on max reasoning. Encryption at rest and in transit. Multi-factor authentication. Results with page numbers, source text highlighted inside the original document, one click through to the underlying file.

Prototype to working, tested app in under a day.

Running locally on my MacBook Pro, searches came back in about a tenth of a second across those 5,000 pages. But the client needed remote access, and that part was non-negotiable, so running it on my laptop was never going to be the answer. Cloud took several more hours. Most of that wasn’t building, it was tuning: sizing the servers and the database against how fast the search came back and what it cost to run, then testing, then resizing, then testing again until the numbers stopped fighting each other. I will say the speed of the current models made that loop tolerable in a way it wouldn’t have been last year. I landed on sub-second response times, which was the number that actually mattered. A second is fast enough to keep your rhythm in a deposition. Three seconds isn’t.

Search “holiday” and you get every passage about holidays. Search “Thanksgiving” and you get those same passages back, because semantic search understands the two are related.

Here are some screen shots I built from a demo system to be able to highlight to clients how this can work. The first three shots show the interface and how you can narrow search results by witness or document type. The final image shows the results when searching for “holiday” - you can see how the results and document highlights.

What it costs

I already had a Vercel subscription (from other client apps I’ve deployed). The data sits in Supabase. If I billed the client for this deployment it would run about $50 a month, including the API cost of the searches themselves.

Now put that next to what you’re paying today. Mainstream e-discovery platforms charge somewhere between $11 and $30 per gigabyte per month just to host data, before seat fees and processing.

Don’t fire your e-discovery vendor over this. Those platforms handle chain of custody, production, privilege logs, defensible workflows. This app does none of that and was never meant to.

The point is narrower and more useful. The distance between “buy the platform” and “build the specific thing you need” collapsed, and most firms are still pricing their options against the old distance.

The question you should have asked four paragraphs ago

If you’re a lawyer, something has been bothering you since I said the word “cloud.” Good. Ask it out loud.

Start with what actually went into the app, because that decision came before any of the security work. Transcripts. That’s it. Not the full case file, not medical records, nothing outside the set of documents the client needed to search. Scoping that narrowly was deliberate. The smallest set of documents that answers the question is also the smallest set you have to defend later.

ABA Formal Opinion 512 is direct on the rest of it: your duty to vet a vendor’s security and confidentiality terms applies to AI tools exactly the way it applies to any other outside service. Rule 1.6 does not relax because the technology is impressive.

Before a single document moved:

1. We only used commercial AI services on paid business terms. I read the data processing agreements, including breach notification and what happens if a vendor is served with process.

2. Encrypted at rest and in transit, multi-factor authentication on every account.

3. No client content is used for model training anywhere in the stack.

The other question: what did it miss?

The app returns ten passages. How do you know there weren’t eleven?

You don’t, unless you check. I ran it against passages I already knew were in the corpus and confirmed it surfaced every one. I also kept exact keyword search running alongside semantic search, so a literal term never disappears into a paraphrase.

Same discipline on the witness summary tool. That one flags inconsistencies across testimony, and flagging is not finding. Every item it surfaced was read by a human against the source document before it went anywhere near a deposition outline. A tool that’s 95% accurate at finding prior inconsistent statements is dangerous the moment you start treating it as 100%.

The claim I’m not making

There’s a version of this article where I tell you the tools got so good that anyone can build anything now. I’ve read that article. I’ve probably drafted it.

It isn’t quite true.

Look at what actually carried this. A year of familiarity with the case. A document index I’d already built. Prior experience deploying secure apps for clients. Knowing which security requirements to specify in the first place, which is something you learn by getting it wrong once.

Codex wrote the code, and the code was the easy part.

What changed is which skill is scarce. Knowing how to build software used to be the bottleneck. Now the bottleneck is knowing what to build, and knowing your subject well enough to catch the output when it’s wrong. That’s good news for lawyers.

What to do Monday morning

1. Pick one document set you search over and over. Index it before you try to build anything on top of it. The index is the asset.

2. Ask your e-discovery vendor what you pay per gigabyte per month. Write the number down. You’ll need it for every conversation after this one.

3. Find one internal workflow where speed matters more than polish and build the rough version yourself. Deposition prep qualifies. Anything headed to a court does not.

One last thing

If you enjoyed this article, please share it with others.

Share Intelligence by Intent

Want help with something like this? Reach out at steve@intelligencebyintent.com.

I drafted this article on Sunday, and Magnus was extremely needy after his morning walk. Here’s the two of us on the couch, not building anything.

Last month I sat across from a managing partner who’d just signed an enterprise ChatGPT agreement. He had one worry, and it wasn’t accuracy. “What if I’m locking in a price for something that gets cheap next year?”

It didn’t take a year. It took three weeks.

What actually happened

OpenAI launched its newest models, the GPT-5.6 family, on July 9. On July 30 it cut the price of Luna, the fastest and cheapest one, by 80%. Terra, the middle tier, got a 20% trim. If you were hoping the flagship, Sol, would follow, it didn’t. It stayed put.

AI pricing runs on tokens, a unit nobody asked for. A token is most of a word. That’s all the vocabulary you need. Luna now costs 20 cents per million tokens going in and $1.20 per million coming out. It was $1 and $6 three weeks ago. I read the announcement twice to make sure I had the decimal right.

And Luna isn’t a toy. OpenAI’s flagship from March scores a 51 on the Artificial Analysis index, a scoreboard the industry leans on to rank model intelligence. Luna, run at full effort, scores a 51 today. Same number. The March flagship cost $2.50 in and $15 out per million tokens. Luna, as of July 30: 20 cents and $1.20. OpenAI is now selling March’s flagship intelligence at about one-thirteenth the token price.

The subscription part

If your firm signed up for ChatGPT Enterprise or the Work plan, you never see a token bill. You see seats and usage limits. So here’s your version of the news: Terra and Luna now draw fewer credits from your plan. OpenAI confirmed the cuts flow through to subscriptions.

Your price didn’t move. Your capacity did.

The contract your firm signed in June now stretches several times further on routine work, and nobody had to negotiate a thing. I’d bet most firms won’t even notice. That’s the real waste here. Not overpaying. Under-using.

The math on one document review

Say you’ve got a matter with 500,000 documents and you want a first pass: issue tags plus a privilege screen. Call it 900 million tokens through the model, most of them going in. (Your e-discovery vendor will quote a different number. Use theirs.)

At Luna’s old prices, that run cost roughly $1,650. At the new prices, it’s about $330. That’s ballpark math, and your real number depends on document length. The direction is what matters. The cost of asking “should we run AI across this whole set?” just fell off the list of reasons to say no.

Why the price war reached your desk

This didn’t happen out of generosity. Chinese open-weight models like DeepSeek have been winning on price all year. By one industry count, they passed the American labs in traffic on OpenRouter, a big AI routing service, back in February. OpenAI needed an answer.

Luna is that answer. On input pricing, it now beats DeepSeek’s discounted rate. On output it’s still more, by about a third. Close enough to call it even.

Here’s why a lawyer should care about that comparison. Most firms I work with could never touch the Chinese models anyway. Client confidentiality rules and outside counsel guidelines shut that door before price ever came up. So cheap AI used to mean a governance headache. Now the vendor your firm already vetted charges about the same as the one it couldn’t use. The discount came to you.

The fine print

The flagship didn’t get cheaper. Hard legal reasoning, the kind you’d trust near a brief, still costs 25 times what Luna does. Cheap tokens don’t verify themselves either. A wrong answer at 20 cents is still a wrong answer, and now you can produce wrong answers at scale. Every workflow still needs a lawyer reading the output.

One more thing. A price that fell 80% three weeks after launch can move again, in either direction. Don’t build a three-year budget on this week’s rate card.

I’ll admit I keep going back and forth on whether cuts this deep can last. My old CFO instinct says margins this thin usually mean somebody’s buying market share. Maybe that’s wrong. It doesn’t change what you should do this quarter.

What to do Monday morning

1. Ask whoever owns your OpenAI relationship which models your plan actually routes to. If the answer is “the expensive one, for everything,” fix that first.

2. Re-run the numbers on any AI project your firm shelved over cost in the past year. The figure that killed it is probably wrong now.

3. Pick one high-volume, low-judgment task and pilot it on the cheap tier this quarter. Intake summaries are a good place to start.

The price of thinking just dropped 80%. The price of judgment didn’t. Make sure your clients are paying you for the second one.

If you enjoyed this, please share this article with others!

Share Intelligence by Intent

What I’m Actually Using: My Summer 2026 AI Stack

TL;DR: I get asked how I keep up with AI more often than any other question. The real answer is three podcasts, a short YouTube list, and about eight tools. My model usage has moved from mostly Claude to a near-even split with ChatGPT, and Google has dropped to roughly two percent of my work. Below is the whole stack, including what I pay for.

I do a lot of keynotes and CLEs, and there’s one question I get every single time. Doesn’t matter if the room is forty family law attorneys or a hundred people at a bar association lunch. Somebody’s hand goes up near the end and it’s always some version of the same thing.

Steve, how do you keep up?

New models drop every few weeks. New tools show up every few days. Announcements that sound enormous and turn out to be nothing, and announcements that sound like nothing and turn out to change how I work. People aren’t asking me to explain AI to them. They’re asking how a person with a full calendar stays current without it eating their life.

So here’s my answer, as of today, July 29th, 2026. I’m writing this at home after an amazing weekend of wine tasting in Paso Robles, and then a couple of days in New York with clients, and a very very late night flight home.

The three podcasts I listen to every day

The AI Daily Brief from Nate Whittemore is first. Every day, without fail. I subscribe on Patreon because I want it to keep existing. What Nate does that almost nobody else does is take a genuinely complicated development in the world of AI and explain why it matters, not just what happened. That gap is the whole game.

Stratechery from Ben Thompson is second. Ben’s business analysis is the reason I keep going back. He does that thing where you read his take on a company or topic and realize you’d been thinking about it wrong for a month. He also does a longer weekly show with Andrew Sharp called Sharp Tech that I love. I happily pay for it.

Nate B. Jones is third. I’ll be honest, sometimes Nate wanders. Sometimes I’m eleven minutes in wondering where we’re headed. But his topics are consistently the most practical for advanced AI users of anyone I follow, and I’ve changed how I work more than once because of something he said around minute twenty.

Who I watch on YouTube

Two tiers. There’s the group where I watch everything they produce, and the group I really like and get to when I can.

I’m a big believer in the power of threes, and the first group happens to be three people: Riley Brown, Theo, and Matthew Berman. Riley and Theo for deep tutorials on new tech. Matt for general AI news and market sentiment. When one of them drops something, I watch it end to end.

The second group is Claire Vo, Greg Isenberg, Allie K. Miller, Joanna Stern (I loved her latest book “I Am Not a Robot”), and NetworkChuck, whose content I pay for. I catch most of it. Not all of it. That’s fine.

Where my model usage actually landed

For about a year I was, as I’ve said out loud and often, Claude-pilled. Writing, reasoning, PowerPoint, Word docs. Claude kept getting better at all of it.

Then GPT-5.6 shipped on July 9th with Sol at the top of the family, and Codex got folded into the ChatGPT desktop app on Mac and Windows. I’ve been doing more and more in the ChatGPT app ever since.

If I look at my usage today, it’s roughly 49 percent Claude, 49 percent ChatGPT, 2 percent Gemini.

I still think GPT-5.6 Sol Pro is the best model on the market for deep reasoning and analysis. Better than Fable for that specific job. Fable does remarkable lateral reasoning, the kind where it connects two things you never asked it to connect. But when I need sustained, in-depth thinking on one hard problem, 5.6 Sol Pro is hard to beat.

Where Claude still wins, and it isn’t close

Writing. Same instructions, same memory, same style guides, and I cannot get the same quality out of Sol on maximum thinking that I get out of Fable 5 or Opus 5. I’ve run this test repeatedly because I keep expecting the gap to close. It hasn’t.

Presentations, same story. I subscribe to Every, and I think Dan Shipper and his team are extraordinary. Their writing pushed me to rebuild my own presentation skill in both Claude and ChatGPT. Even with that same work applied to both, Fable 5 and Opus 5 produce better slide structure, better analysis, better diagrams, better tone. I’ve got months of side-by-side examples sitting in a folder. When I’m building presentation for clients that matter, I still start in Claude.

I try it in both anyway. Every time. I keep hoping to be wrong.

Where ChatGPT took over

Day to day, Codex is where I live now. Client work, research, analysis, structuring documents, drafting emails, building applications. I like Claude better for front-end design, no question. But for custom applications I’m actually deploying to clients, Sol has been astonishing.

The desktop app is a real part of this and I did not expect that. I was a fifteen-browser-tabs person for years. Moving between endless chats, cowork, and code in one window changed my defaults inside of a week. The way projects hold context, the in-app browser, computer use, the way connectors work, the fact that long-running jobs just run while I do something else. The latest ChatGPT desktop app is amazing.

Most of my conversations now happen in Claude Code and in Codex (at this point I’d say 80% desktop apps, 20% in terminal) rather than in a chat window at all. I’ve built custom memory systems to track everything across both. That deserves its own post, with screenshots, so I’ll do that one next.

What happened to Google

I’ve almost entirely stopped using Gemini and I’m genuinely bummed about it.

Gemini 3.1 Pro was the last frontier model they shipped and I liked it (and used it) a lot. They put out 3.5 Flash at I/O, which I was lucky enough to attend in person, then 3.6 Flash on July 21st. Both are fast and responsive and I’ll still fire off the occasional query. But 3.5 Pro keeps slipping, and a Flash-only release cadence is not a frontier strategy. The focus now is on Gemini 4 and there’s no real timeline.

Gemini Spark is the exception. I’m an Ultra subscriber and their personal agent is great. My single best use case, and I’m a little sheepish admitting it: travel planning. It’s fantastic at travel planning.

I also want to like Gemini Notebook, the product Google renamed from NotebookLM on July 16th. I just don’t have a use case that survives contact with my actual week.

The tools I can’t work without

Wispr Flow. I’m dictating most of this article using Wispr Flow. I use it all day, every day, and I now speak to my computer far more than I type. If you try one thing from this article, try this one.

Granola sits in every call I take. It captures the conversation, gives me a transcript and a summary I’d actually forward to someone, and I’ve built integrations that push all of that into my CRM and my Obsidian memory system without me touching it. Meeting notes stopped being a thing I do.

Raycast handles the rest. Shortcuts, clipboard history, snippets, launching things, small automations. It’s the tool I’d notice missing in the first ten minutes of a workday.

And then Obsidian, which is where my knowledge management (memory) genuinely lives now. Client research, article research, all of it. I use Clearly for heavy Markdown work and Camtasia for video recording, but those are situational. Wispr Flow and Granola are the two I’d fight you over.

What I pay for, and why I’m telling you

You should know what somebody has paid for before you take their recommendations.

I pay for Nate B. Jones, the AI Daily Brief on Patreon, NetworkChuck, Stratechery, Every, and SemiAnalysis. SemiAnalysis is worth calling out separately. Their insights are remarkable, and if you care about what’s happening at the hardware layer, which increasingly decides what’s possible at every layer above it, it’s the best money on this list.

None of this is sponsored. Nobody’s paying me. I’m paying them, which is the disclosure that actually matters.

What to do Monday

Don’t copy my stack. Copy the shape of it.

1. Pick one daily podcast and actually listen to it daily. One. The compounding is real and it costs you a commute.

2. Run one real task through two models this week. Same prompt, same context, same instructions. Not a benchmark, an actual piece of your work. You’ll learn more in an hour than from a month of reading comparisons.

3. Install a dictation tool and use it for a week. Highest-return change I’ve made in two years, and it has nothing to do with which model is winning.

Two people

I’d be leaving out the most important part if I stopped at software.

Two people I want to name, first names only: Lauren and John. We went to business school together at Wharton. For several years now - they’ve been beyond regular friends and colleagues - they’ve been the people who push my thinking when it needs pushing on AI. Every. Single. Day. Half of what I believe about this stuff, I believe because one of them made me think about it first.

The tools turn over every six weeks. That part doesn’t.

Share Intelligence by Intent

PS: After traveling for almost 6 days, Magnus hasn’t left my side. Here are two photos from earlier today. Enjoy.

TL;DR: On Thursday, July 23, Anthropic and OpenAI both shipped voice that acts instead of answers. Claude’s voice mode now runs on Opus and Sonnet and reaches your connected Gmail, Calendar, Docs, and Slack from your phone. OpenAI’s version directs multiple agents inside Work and Codex, but only from the Mac or Windows desktop app, with a paired iPhone as the remote. Neither reaches everything, and what each one can’t touch matters more than what it can. The question for your firm isn’t whether to try it. It’s what a spoken sentence should be allowed to set in motion.

The drive home

You know the drive. Hearing ends at 3:40. You’re on the road by four, and somewhere around the second exit you’ve worked the whole thing out: the client needs a call tonight, opposing counsel needs a letter, the new date has to go on the calendar before somebody double-books you, and there’s a case from two years back that might actually be the answer if you could remember the name. By 5:15 you’re at your desk, three people have found you, and two of those four things are gone.

That drive is what changed last week.

Not because you can talk to an AI. You’ve been able to do that since 2025, and it was fine, and it didn’t matter. What changed is that the thing on the other end can now open your calendar and move the hearing, pull the email thread and draft the response, and leave the work sitting in your drafts folder waiting for you to look at it. The conversation ends with something you can use instead of a summary you’ll never open again.

What shipped, precisely

Both landed the same Thursday. Which, fine, nobody schedules those things by accident. What I didn’t expect was how little the two releases actually have to do with each other.

Anthropic’s voice mode came off its diet. Since launch it had run only on Haiku, the small fast model, which is exactly why every attorney I’ve watched try it walked away shrugging. It’s now on Opus and Sonnet. It picks up whichever model you last used in text chat, and you can switch mid-conversation. It reaches the tools you’ve connected: Gmail, Google Calendar, Google Docs, Slack, plus Canva and Notion in Anthropic’s own examples. It’s in beta on every plan, on iPhone, Android, the desktop app, and the web, though Anthropic says plainly that it’s built to work best from your phone. Fable, the strongest model in the lineup, isn’t available in voice at all.

One design detail worth knowing: Claude’s voice takes turns. It listens, stops, thinks, answers. OpenAI’s doesn’t.

OpenAI put ChatGPT Voice inside the desktop app on macOS and Windows, running on GPT-Live, which listens and speaks at the same time. It feels less like dictating and more like talking over a colleague. Inside Work and Codex, voice becomes a control panel. Start a task, interrupt it, redirect it, kick off a second one while the first keeps running, ask what’s blocked. Plus, Pro, Business, Edu, and Enterprise. Not Free.

And here’s the constraint the coverage skipped. Voice in Work and Codex is a desktop capability. There’s no standalone version on the web or on your phone. You can reach it from an iPhone, but only as a paired remote for a desktop that’s sitting somewhere awake and logged in. Android support is “coming soon.”

What neither one can touch

Now the part that isn’t in anybody’s launch coverage, because it’s buried in Anthropic’s own help center.

Claude’s voice mode does not work with Cowork or Claude Code. Anthropic states it flatly, then adds the sentence that should stop you cold: voice “will not be able to reference the projects and skills you have set up in Cowork.”

Read that twice if your firm has done any real setup work. Your matter templates aren’t reachable from the microphone. Neither is the intake skill somebody spent a weekend building, or the project holding eight months of context on a case, or that demand letter format your associates finally quit arguing about. Voice sees chat and connectors and nothing past them.

OpenAI has the mirror-image problem. Its voice can drive the agents that do the deep work, and it’s chained to a desk while it does.

So the microphone got a promotion. It used to be a stenographer. It’s a dispatcher now. The dispatcher just can’t reach the whole building, and each vendor has walled off a different wing.

What this looks like in an actual practice

For the lawyer, I’d stop talking about billable hours altogether. Clio’s Legal Trends Report has the average attorney at roughly three billable hours out of eight, and whenever that number goes up on a screen somebody in the room says their firm runs better than that. Maybe they do. The five hours nobody argues about are the ones that go to scheduling, follow-up, reconstructing where the day went, and the small stuff that never makes it into a time entry at all. A twenty-minute drive that ends with the hearing moved and two emails drafted won’t add an hour to anyone’s sheet. It stops one from disappearing.

For paralegals the case is simpler, and I’d argue this is where firms see the first honest return. Walking back from the clerk’s office, a paralegal can ask for the docket entry summarized and the new deadline calculated before the elevator shows up. Hands full, eyes busy, brain free. That’s the actual shape of the job.

(Every demo of this eventually says the word Jarvis. The one I watched this week said it twice. I’d gently point out that Tony Stark never had to run a conflicts check.)

Judges are where I slow way down. Some of the administrative uses are easy to defend, chambers calendaring being the obvious one, and I’d put a plain-English briefing on an unfamiliar technical field before a Daubert hearing in the same bucket. But Ohio’s Board of Professional Conduct put out guidance on May 1 specifically warning judicial officers off AI for legal research and opinion drafting, reasoning that the independence required of a judge is different in kind from what a first draft gives an attorney. I think that’s right, and voice makes the wrong version easier, because talking doesn’t feel like using a tool. It feels like thinking. If a judge asks me: calendar and logistics, yes. Anything a party would want to cross-examine, no.

The part that will get somebody in trouble

Start with the training defaults. On Claude’s consumer plans, Free, Pro, and Max, your conversations feed future model training unless somebody went in and turned that setting off. Retention runs five years with it on, thirty days with it off. Team, Enterprise, and API traffic are excluded under the commercial terms. ABA Formal Opinion 512 already told us that putting client information into a self-learning tool requires the client’s informed consent, and that boilerplate buried in an engagement letter doesn’t get you there. Voice doesn’t change that analysis one bit. It makes it much easier to forget.

Then the open microphone. Claude’s default is hands-free, meaning it listens continuously and answers at natural pauses. Sit in a conference room with a client, or a car with a witness, and that microphone is picking up both of you while a transcript lands in your chat history. In California and the other all-party consent states, whether that counts as a “recording” under the wiretap statutes is genuinely unsettled, and the plaintiffs’ bar is already testing adjacent theories against AI notetakers. I don’t know how those cases come out. I do know I’d switch to push-to-talk in any room with another person in it.

One more that sounds small and isn’t. OpenAI’s documentation says voice transcripts are not verbatim records. Perfectly fine for thinking out loud. Not fine for anything you’d later characterize as what was said.

Three things to do Monday

1. Open your connector settings on both platforms and look at what’s actually authorized. Not what’s available. What’s switched on right now, and who switched it on. Most firms I work with have never looked, and that list is now reachable by anyone who can talk into a phone.

2. Check the training toggle on every consumer account at the firm. If your associates are running personal Pro plans, that’s a Rule 1.6 conversation, not an IT preference.

3. Pick one workflow and run it by voice for a week. One. The firms that get value from this won’t be the ones that tried everything at once.

The drive is still forty minutes. Nobody fixed that part.

Thanks for reading. If you enjoyed this, please share it with others.

Subscribe now

Claude Opus 5 Is Here. Pick Your Model by the Cost of Being Wrong.

TL;DR: Opus 5 shipped July 24. Same price as Opus 4.8, $5 and $25 per million tokens, and it tops Anthropic’s reported coding and knowledge work benchmarks. Voice mode got Opus and Sonnet the day before, along with reach into your email and calendar, which is the part your firm should actually be worried about. Sonnet 5 is enough for most of what you do. Opus 5 for the work nobody’s going to double-check.

The notification hit while I was halfway through a drive up to Paso Robles for a wine weekend, and my first reaction wasn’t excitement. It was a small, tired sigh.

If you run a firm, you know the feeling. “Keeping up” stopped being a reasonable goal sometime around March. Sonnet 5 landed June 30. Fable 5 and Mythos 5 arrived June 9, then Fable got pulled for nearly three weeks over export controls and came back July 1. Now Opus 5. Four significant releases in under seven weeks, every one of them arriving with a chart showing it beat the last one.

I’m going to skip the chart.

What Anthropic actually shipped

Opus 5 costs exactly what Opus 4.8 cost. Five dollars per million tokens in, twenty-five out. Same sticker, better model, which is not how this usually goes. It’s the default now on Claude Max and the strongest option on Claude Pro, and Anthropic’s claim is that it lands close to Fable 5’s intelligence at half Fable’s price.

The legal-adjacent numbers are the ones I’d actually read. A contract AI vendor testing first-turn redlines said Opus 5 scored highest of anything they’d tried, close to double Opus 4.8. Box measured 17 percent better than Opus 4.8 on due diligence workflows. A second legal vendor saw its biggest gains in corporate governance and arbitration, and matched Opus 4.8’s max-reasoning quality on 26 percent fewer tokens, which matters more than it sounds if you’re paying by the token. All customer testimonials from Anthropic’s own launch post, by the way. Nobody independent has run any of it.

Then there’s an alignment result nobody covered. Anthropic runs an automated behavioral audit on its own models, and Opus 5 came out lowest of any recent model on misaligned behavior. Lowest rates of deception. Hardest to talk into something it shouldn’t do. I’d trade five points of coding benchmark for that in a heartbeat, because the person handing this thing privileged material at 11pm is not going to be the person who understands what it is.

Everyone’s arguing about the wrong number

I ran the cost numbers because someone always asks.

Two million input tokens in a month, two hundred thousand out. That’s heavy drafting and review for a small firm. Opus 5 comes to roughly $15. Sonnet 5 at its standard rate, roughly $9.

Six dollars.

I have watched practice groups spend forty minutes on this. And most of you are on subscriptions anyway, buying usage limits rather than tokens, so the whole exercise is theater.

So price isn’t the variable. Difficulty isn’t either, though that’s the one people reach for second. Some of the worst AI failures I’ve watched land in firms came out of work nobody would call hard. Just a lot of it.

Pick by what it costs you to be wrong.

Opus 5 or Sonnet 5: a working rule

Sonnet 5 handles anything you’re going to read anyway. First drafts, summaries of your own notes, reformatting a deposition outline, research you’d verify no matter who produced it. It’s the default on Free and Pro, it’s quick, and at $2 per million input tokens through August 31 it’s cheap enough to leave running in the background.

Opus 5 is for work you can’t check. Not hard work. Unverifiable work.

That gap is wider than it looks. If an associate runs eight hundred documents for privilege, nobody is re-reading eight hundred documents. And if a model runs a twenty-step research task, an error in step three quietly poisons everything downstream while looking entirely reasonable on the page, which is the failure mode that actually scares me. The Friday 6pm redline going to opposing counsel with no second pass belongs in the same bucket. Six dollars is not a consideration for any of these.

My own first test on a new model isn’t serious. I ask it to plan a week of meals for a 165-pound St. Bernard with loves freshly BBQ’d steak. Magnus is not a benchmark. But I’ve run the same prompt on every model for two years now, and inside a paragraph I know whether it’s going to hedge itself into uselessness or commit to an answer. Opus 5 committed. Make of that what you will.

Voice mode grew up, and that’s a confidentiality question

Quick correction to how this is being reported. Voice isn’t an Opus 5 feature. It shipped on its own, July 23, as a Claude app update rather than anything to do with the model.

It’s also the more consequential release for your firm.

Until then, voice ran everything through Haiku, whichever model you were using in text. Now it runs on Opus and Sonnet, reaches connected tools like Gmail and Slack, and asks permission before touching them. Turn-based, so Claude listens, pauses, answers. Still beta. Best from a phone.

Which makes this the first version that could hold a real conversation about a real matter. That’s the problem.

A partner talking through a matter in the car with the Gmail connector live is generating a written transcript that lands in chat history. Confidentiality surface. Possible discovery surface. And it showed up on every associate’s phone without anybody at your firm deciding it should. Free accounts stay on Haiku with one connector, which is worth knowing if your paralegals are logging in with personal accounts, and some of them are.

Before you switch

Trip Anthropic’s cyber safety classifiers inside Claude.ai, Claude Code, or Cowork and the request falls back to Opus 4.8. You will not always be running the model you picked. Mostly this touches security and investigations work, though it’s exactly the sort of thing that surfaces at the worst possible hour.

Sonnet 5’s introductory pricing dies August 31. September 1 it goes to $3 and $15. Build the budget on the September number.

The tokenizer one is buried in the pricing docs and nobody mentions it. Everything from 4.7 forward turns identical text into roughly 30 percent more billable tokens than the older models did. Which means if you’re holding this year’s spend against last year’s and drawing a conclusion about efficiency, you’re not. You’re measuring a tokenizer change and calling it a trend.

Monday morning

1. Sonnet 5 as the default, Opus 5 for anything that reaches a client or a court without a second read. That’s the whole policy.

2. Write the voice rule before somebody needs it. One paragraph covering whether voice gets used on client matters and which connectors stay live when it does. Enterprise owners who want it off entirely have to ask Support, since there’s no toggle for it.

3. Pick one recurring task and run it both ways for a week. Count the fixes, not the minutes.

I’ll be writing one of these again in six weeks. The question underneath it won’t have moved.

TL;DR: OpenAI models used an unknown software flaw to leave a controlled test environment and enter another company’s systems while hunting for test answers. There is no evidence of consciousness or rebellion. The incident gives firm leaders a practical question: when AI is connected to firm systems, which decisions still belong to a person?

During an internal cybersecurity test, OpenAI says its models found an unknown weakness in software used to keep them contained. They used it to reach the public internet and enter the systems of Hugging Face, a major online platform where developers store and share AI models and data. Their apparent objective was surprisingly mundane: find the answers to the test.

I keep coming back to a simpler part of the story. The models were given a goal. They pursued it beyond the boundaries their human operators expected them to respect, and once they found a path, they took actions no one had authorized.

The science-fiction version is wrong

OpenAI was running a specialized security evaluation rather than an ordinary ChatGPT conversation. Some usual safety restrictions had been intentionally reduced, and one of the models had not been publicly released. This was a deliberate attempt to find out how capable the systems had become.

There is no evidence that the models became conscious or decided to attack another company. OpenAI says they remained narrowly focused on the assigned problem. Hugging Face reported unauthorized access to some internal information and service credentials, but found no evidence that its public models or published software had been altered. Both companies are still investigating.

The absence of a robot rebellion makes this more useful for firm leaders. The models behaved as increasingly capable AI systems are designed to behave. They divided an assignment into steps and kept working when they encountered obstacles. The problem was the distance between the objective humans intended and the actions the systems could take while pursuing it.

The problem begins when the AI gets the keys

Most lawyers still experience AI as a conversation. You ask. It answers. The lawyer decides whether to use the response and is expected to catch any problem before it reaches a client or court.

An AI agent works differently. It can continue through a longer task, use other software, and take actions without asking permission at every step. In a law firm, that could eventually mean finding documents, updating a matter file, monitoring deadlines, or communicating with clients.

Imagine a simple firm rule: lawyers may use AI to draft an email, but the AI may not send it. That rule is easy to enforce when the tool sits in a separate window and only produces text. Connect that same tool to the firm’s email system, and the rule suddenly has to restrain software that can act through a lawyer’s account rather than merely produce text in a separate window. The key is already there.

This is where the distinction between access and authority becomes important. A junior associate may be told not to send a client letter without partner approval. The firm also limits which matters the associate can access. We do not ordinarily hand someone every key and rely entirely on an instruction to use only the right one.

The friendly chat screen can hide that distinction. An agent may be assigned to one matter while its connection to the document system allows it to search many. It may be told to prepare a client communication while its email connection also gives it the ability to send.

When the tool only drafts, the mistake sits on the screen. A lawyer can still catch it. Give that same system the ability to send the message or change the file, and the timing changes. The mistake may surface after something has already happened. Now the firm is reconstructing an event.

The ethics rules already reach this problem

The legal profession does not need an entirely new ethical code to recognize the issue. ABA Formal Opinion 512 already connects AI use to professional competence and supervision, including provider security. It tells managerial lawyers to establish clear policies and understand the tools their firms use.

The opinion is not a technical manual, and I do not read it as one. But its practical meaning changes as the tools become more active. Supervising a system that proposes language is largely about checking the language. Supervising a system that can act requires the firm to decide where a person must remain involved and how the firm will know what the system actually did.

Most firms will buy these capabilities from legal technology companies or providers already embedded in firm systems. The Hugging Face incident shows why “the vendor handles security” cannot be the whole answer. OpenAI’s models, its test environment, outside software, and Hugging Face’s systems all became part of the same event.

A firm could face a similarly blurred line. If an AI retrieves information from the wrong matter because it had broad access, was that a model failure, a product-design problem, or a firm permission decision? The client affected by the mistake is unlikely to care very much about those distinctions.

A managing partner does not need to know how each technical component works. But someone inside the firm should understand what the agent can reach, when it can act without approval, and who can stop it. The firm’s duties to its clients do not transfer to a technology provider.

I don’t think this incident is a reason for firms to stop exploring agents. OpenAI created unusual test conditions, and both companies stopped the activity and disclosed what they knew. The ability to carry work forward may be genuinely useful.

But the next vendor demonstration should go beyond accuracy and time savings. Before the meeting is over, someone should ask one more question.

What can this system do before one of our lawyers has the chance to say no?

The Model Passed the Bar. Now Your Firm Has to Pass the Matter.

TL;DR: Forty-three dollars is the number I can’t get past. That is what a strong Supreme Court memo would have cost at Claude Fable 5’s token rates, compared with at least $12,000 of associate time. But the best system depended on how the writing model and research tool were paired, and a separate perfect score still hid a material problem in the statutory analysis. Cheap intelligence changes firm economics; complete work still depends on review design and how the service is priced.

In a June 11 experiment, University of Houston law professor Seth Chandler gave the same Supreme Court jurisdiction problem to several combinations of writing models and legal research tools. Fable, connected to free research tools including the CourtListener database, earned his top grade. Chandler was using a monthly plan, but he calculated that the Fable work would have cost about $43 had he been paying by the token. His human comparison is easy to audit: a minimum of 20 associate hours at $600 or more per hour, or well over $12,000.

Chandler did not conclude that Fable had simply beaten everything else. ChatGPT 5.5 paired with CoCounsel earned a strong A-minus, while Claude Opus paired with CoCounsel earned a B-plus. His takeaway was that the best choice depends on the pairing of the writing model and research tool, as well as who is paying for the tokens. He also found that a strong research product can lift a model that is no longer at the frontier to work that is ready for partner review. That is much closer to my thesis than a model horse race.

When I put $43 next to $12,000, I don’t see a benchmark. I see a partner compensation problem. In the traditional firm model, associate hours produce revenue and contribute to partner profit while also training the associate. If a machine compresses much of that effort into a ten-minute run, the firm’s cost curve moves before its billing model does.

Chandler’s experiment was one legal problem, not a market study. He also had to redirect the model, ask it to review the Supreme Court docket, and press it on a weakness in its initial analysis. That human intervention is part of the result, not an inconvenient footnote. Even with that caveat, a first draft that would have cost $43 and belongs in a partner’s review queue changes the economics of the assignment.

The six-dollar bar exam is the smaller story

Matthew Stubenberg reported another arresting number this month. He and a team at the University of Hawaii’s William S. Richardson School of Law have been running AI models against the same 210 released Multi-state Bar Examination practice questions as each new model arrives. Claude 3.5 Sonnet led their first published round with 181 correct. By September of last year, GPT-5 was at 97.6% and more than two-thirds of the models they tested were beating the average human test-taker. Fable just answered all 210 correctly, for about $6.

I don’t dismiss that result. It tells me the baseline legal knowledge available through a general-purpose model has moved a long way in under two years. But these are released multiple-choice questions with defined facts and known answers. They don’t require the model to work through an untidy matter file, find what is missing, use the firm’s preferred form, or identify the point that needs a partner’s judgment.

Harvey has tested that harder part. Its Legal Agent Benchmark contains more than 1,200 assignments across 24 practice areas, each built around a client matter and a reviewable work product. A task passes only when every required criterion passes. Fable scored 93.4% on Harvey’s shorter-task benchmark, but only 13.3% under the all-pass standard for complex assignments.

That is the gap I care about.

The model can know the law, produce an impressive draft, and still leave the firm with the expensive part: finding the consequential miss before the client relies on it. The $43 figure changes the production cost. It doesn’t tell us the cost of making the work complete.

The perfect score still got the legal posture wrong

DingDuff gives us a clean example. Two practicing Texas lawyers built the free connector so Claude can search court opinions and statutory text directly. In the founders’ veil-piercing benchmark, Fable with DingDuff scored 11 out of 11 on the legal issues. Their reviewers also marked all 131 evaluated citations correct.

Then the grading notes reveal the part I would put in front of every partnership. The prompt asked whether reverse veil-piercing was available. Texas amended its Business Organizations Code in 2023 to clarify that the charging-order provisions, including the exclusive-remedy rule, apply to single-member LLCs. The Act itself says the change was intended only to clarify existing law. Every system relied on case law that predated the amendment. Fable was the only one that flagged the statute, but it described the tension as an “unresolved collision” rather than treating the statute as controlling. DingDuff’s graders, both Texas attorneys, said the earlier cases had been abrogated and the statutory answer controlled.

The benchmark still awarded Fable a perfect 11 out of 11 because its scoring rule gave credit for spotting the statute. On DingDuff’s own account, the memo nevertheless misstated the legal posture on an issue the prompt expressly required it to resolve. If a client’s strategy depended on the availability of that remedy, the difference between an unresolved conflict and a statutory bar could change the advice. A perfect benchmark score didn’t produce perfect legal work.

That’s why I’m wary of accuracy claims presented without the grading file. The citations can all be real. The model can identify the right statute. The answer can still be wrong in the way that matters to the client.

The free connector has a real governance design

DingDuff’s governance choices deserve more attention than the word “free.” Its terms limit the service to licensed U.S. attorneys and require users to verify every output independently. Its privacy policy says the company receives tool-call parameters, not the surrounding Claude conversation, and retains those parameters for no more than seven days. The citation-checking logic runs locally. DingDuff’s current README says the document can still transit DingDuff when the interactive panel is rendered, although it is neither stored nor logged. A standalone review.html file avoids that transit entirely, so a firm evaluating the tool should know which mode its lawyers are using.

I like the division of labor in the citation checker. Quotes are matched by code against the source text rather than accepted from the model’s memory, which means an invented quotation cannot receive a verified highlight. The lawyer still decides whether the source supports the proposition and remains good law. The software checks what software can check, then puts the legal judgment back where it belongs.

The model itself presents a separate retention issue. Anthropic’s current Fable page still says every use requires 30-day data retention for safety monitoring. Harvey tells its customers the same thing: Anthropic retains inputs, outputs, and documents for 30 days, and may keep them longer when content is flagged for safety review or when the law requires it. Chandler concluded on June 11 that the policy could make Fable inappropriate for general legal use while it remains in place. I wouldn’t treat that as a blanket prohibition, but I would treat model selection as a matter-level governance decision. A $43 draft is not cheap if its retention posture conflicts with the firm’s obligations or the client’s instructions.

The incumbents are not standing still. Thomson Reuters released a CoCounsel connector for Claude in May. Today it lets Claude start a CoCounsel deep-research project, monitor it, and retrieve a cited report. DingDuff co-founder Kyle Dingman’s criticism is that this gives Claude access to a report produced by CoCounsel’s AI rather than direct access to the underlying corpus.

I think that distinction sharpens the vendor question. Asking whether a product has a connector is no longer enough. A firm should ask what the connector actually exposes and which system is doing the legal reasoning. The review record should be the next question.

The advantage has moved to the firm’s operating model

My view is straightforward: the model is no longer the durable advantage. Every major platform can adopt a stronger model when one appears, and a small team can now connect that model to primary law at low cost. Enterprise products can still earn their price through source coverage, security controls, administration, support, and repeatable workflows. Access to capable legal intelligence by itself no longer explains a premium price.

The same is true for law firms. Buying a platform that every competitor can buy does not create much separation. The firm creates value through its matter context and the standard of its review, then turns both into a service the client will buy. That is where its knowledge and client relationship still matter.

The economics require an equally direct answer. Under an hourly model, reducing associate time can reduce revenue unless the firm finds more volume or raises rates. Hiding the efficiency inside a traditional bill invites a client challenge once the cost difference becomes visible. A defined service with a fixed or value-based price gives the firm a way to share the gain with the client while preserving a return for the judgment and responsibility it still provides.

What I would do Monday morning

1. Build one benchmark around firm economics. A practice leader and the finance team should choose one recurring assignment and create ten representative test matters. Measure the quality of the final work, total production cost, partner review time, and the price a client would accept. The answer you need is not which model wins; it is whether the firm can deliver the work more profitably without lowering the standard.

2. Test for consequential misses. Seed the matters with amended statutes, stale cases, conflicting documents, and one fact that changes the advice. Require the system to show its sources and require the reviewing lawyer to record what the automated checks did not catch. Track the misses that would change a deadline, recommendation, or client decision.

3. Set the client offer before scaling the tool. Define the scope, review standard, turnaround time, and price for the AI-assisted service. Decide what the client will be told about the process and how the savings will be shared. If the firm cannot explain the value without pointing to hours, the service design is not finished.

The $43 memo and the 11-out-of-11 miss belong in the same partner meeting. One shows how quickly the cost of producing legal analysis is falling. The other shows why responsibility for the finished work has not moved with it. My concern is that firms will automate production without redesigning either review or economics.

Until a firm can say who verifies the cheap draft, what that verification costs, and how the client participates in the gain, it doesn’t have a durable AI service. It has a cheaper draft.

Share Intelligence by Intent

AI Isn’t Underperforming. Your Workflow Is.

TL;DR: Four independent research teams surveyed more than 11,000 executives and professionals over the past six months, and they converged on the same uncomfortable finding: most organizations report no measurable business impact from AI. The technology isn’t the problem. The firms seeing real returns rebuilt the work around the tool. Everyone else bolted AI onto a process designed for humans and declared victory.

You know this meeting. Somebody pulls up the license dashboard, adoption looks healthy, a partner mentions the summary feature saved her an hour last Tuesday. Everyone nods. And then the CFO asks the question nobody wants: where does any of this show up in the numbers?

It doesn’t. And a wave of new research says your firm has a lot of company.

Nine in ten executives report nothing

An NBER working paper released in February surveyed nearly 6,000 senior executives across the US, UK, Germany, and Australia. The headline finding: nine in ten report no impact from AI on employment or productivity at their own firms over the past three years.

Read that again. Not “modest impact.” Not “impact we’re still quantifying.” Nothing. Zip. Zilch. Nada.

My first instinct was to write this off as one weird sample. Then I went looking for a survey that contradicted it and couldn’t find one. McKinsey’s latest State of AI research, roughly 2,000 organizations, found only 39 percent could attribute any bottom-line impact to AI at all, and most of those pegged it below 5 percent of earnings. Writer surveyed 2,400 executives and employees this spring and landed at 29 percent seeing significant ROI from generative AI. Even the narrow ones agree (Gartner asked 114 HR leaders and got 88 percent reporting no significant business value). I kept waiting for one of these to break the pattern. None did.

Here’s the detail from the NBER paper that stopped me, though. Two thirds of those executives personally use AI. Their average usage: 1.5 hours a week.

An hour and a half. A week. That’s not a technology strategy. That’s a browser tab.

The “not yet” problem, and why it should worry you more

Now, the honest read of this data is not “AI doesn’t work.” The same NBER executives who report zero impact so far predict sizable gains over the next three years: productivity up, output up, headcount down. They believe the value is coming. They just haven’t seen it land yet.

Which raises the real question. If the technology is this capable, and everyone believes in it, why hasn’t it landed?

The Writer survey gets closest to an answer, almost by accident. Individual AI super-users in that study are five times more productive than their slower colleagues. They save about nine hours a week. Real, measurable, at the level of one person. And yet only 29 percent of their organizations see significant ROI.

So the gains exist. They’re just evaporating somewhere between the individual and the P&L.

I’ve watched this happen inside law firms for two years now. An associate uses AI to cut a first draft from four hours to forty minutes. Great. Then the draft sits in the same review queue, goes through the same three-partner sign-off, gets billed against the same hourly assumptions, and lands on the client’s desk on the same day it would have anyway. The associate got faster. The matter didn’t. The firm captured none of it.

That’s not a tool failure. That’s a workflow that was never redesigned to absorb the speed.

What the winners actually did differently

McKinsey’s data puts a number on this. Their AI high performers, the roughly 6 percent of organizations attributing meaningful earnings impact to AI, are nearly three times as likely as everyone else to have fundamentally redesigned their workflows. Of the 31 organizational factors McKinsey tested, workflow redesign ranked among the strongest predictors of actual business impact. Not model choice. Not spend. The rebuild.

And the losing pattern has a name too. Writer found that 75 percent of executives admit their company’s AI strategy is “more for show” than actual guidance. Seventy-five percent. These are the same leaders approving seven-figure AI budgets, by the way; 59 percent of surveyed companies spend over a million dollars a year on this.

So here’s how I’ve started putting it to firms: buying the tool is the easy 20 percent. The value lives in the other 80 percent, which is the part nobody wants to do. Mapping how work actually flows through your firm. This is where I’m personally spending the bulk of my time with clients. Deciding what a matter looks like when drafting takes minutes instead of hours. Changing who reviews what, and eventually, though nobody wants to say it out loud yet, confronting what all this does to the billable hour. That work is political. It steps on toes. It has no launch party.

Which is exactly why so few firms do it, and exactly why it’s where the advantage sits.

One more data point, because it explains a lot. Thomson Reuters’ 2026 professional services report found only 18 percent of organizations even track ROI on their AI tools. Roughly the same as last year. You can’t capture value you refuse to measure. Most firms haven’t skipped the redesign because they tried it and failed. They’ve skipped it because nobody’s looking.

The fair objections

A managing partner pushed back on me recently with a version of this: redesigning workflows mid-year, with paying clients in the pipeline, is expensive and risky, and the models keep changing anyway. Why rebuild around a tool that looks different in six months?

It’s a fair point, and partly right. If you’d rebuilt your intake process around the best model of early 2024, you’d have rebuilt it again by now. Redesign has a shelf life.

But notice what that argument assumes: that the redesign is about the tool. It isn’t. The durable work is mapping your processes, measuring your baselines, and deciding which handoffs exist because they add judgment versus which exist because they always have. That analysis survives every model release. The firms doing it now will swap tools in and out for a decade. The firms waiting for the technology to “settle” are waiting for a day that isn’t coming.

The other objection is quieter: maybe zero measured impact is fine, because the individual time savings are real even if finance can’t see them. Maybe. For about another year. Then your competitor prices a matter based on their rebuilt cost structure, and you find out what “we couldn’t measure it” actually cost.

What to do Monday morning

1. Pick one workflow, not one tool. Take a single high-volume process, intake, first-draft discovery responses, monthly reporting, whatever hurts, and map every step and handoff. Then ask which steps exist only because a human used to do the prior step slowly.

2. Set the baseline before you touch anything. Hours per matter, turnaround time, review cycles, write-offs. If only 18 percent of organizations track AI ROI, being in that 18 percent is one of the cheapest advantages available right now.

3. Rebuild the one workflow end to end, and measure again in 90 days. Not a pilot. Not a lunch-and-learn. Change the actual sequence of who does what, let the numbers tell you whether it worked, then take the playbook to workflow number two.

That’s it. Unglamorous on purpose. The nine-in-ten firms reporting nothing didn’t fail at AI. Most of them never actually started.

The tool was never the moat. The rebuild is.

Share Intelligence by Intent

If you enjoyed this, please share it with others. Here’s a couple of shots of Magnus from the last 24 hours.

Chilling on the couch with his favorite Lammie toy:

Breakfast of champions: lemon loaf cake with whip cream (thanks, Coffee Bean!).

Lunch. Filet mignon. Costco’s finest ;)

So glad he’s not spoiled.

Claude and ChatGPT Both Added an In-App Browser. Only One Lives Where Lawyers Work.

TL;DR: In one week this month, Anthropic and OpenAI both put a web browser inside their desktop apps. The headline is the same. The placement is not. OpenAI put its browser in the mainstream ChatGPT app, wired to its new ChatGPT Work agent, which is exactly where a non-technical attorney will spend time. Anthropic put its browser inside Claude Code, the developer tab most lawyers will never open. For a firm, that one difference decides which tool your people can actually use, and then which risks you have to manage.

Here’s the question a managing partner should ask first. Not “which browser is better.” Ask which one your attorneys will ever touch.

Because a capability nobody opens is worth nothing.

Both companies shipped in the same week. Anthropic added a browser pane inside Claude Code on July 10. The day before, OpenAI said it’s retiring its standalone Atlas browser and folding web browsing into the ChatGPT desktop app, plus a Chrome extension. Same headline: the browser now lives in the app. But read where each one put it, and the story splits in two.

Where each browser actually lives

OpenAI put its browser in the room where the work happens. The new ChatGPT desktop app carries three things in one place: regular chat, ChatGPT Work, and Codex. ChatGPT Work is the new agent that takes a goal, gathers what it needs across your files and the open web, and hands back finished work, a spreadsheet or a drafted memo, not just an answer in a chat window. The browser is part of that same surface. It logs into your accounts, downloads files, and opens tabs. A second browser running on OpenAI’s servers can go finish a task while you do something else. An associate drafting a memo, a partner running a background check, they’re already in this app. The browser is right there with them.

Anthropic put its browser somewhere else. The Claude desktop app has three tabs: Chat, Cowork, and Code. The new browser pane lives in Code, the software-development tab. It’s built for a developer writing an app who wants to preview it and click through it without leaving the coding window. It’s a good tool. It is also a tool a litigator is never going to open. Most attorneys will not spend a minute in a coding environment, which means the browser sitting inside it may as well not exist for them.

That’s the whole ballgame.

Why this is the point, not a footnote

Think about how an attorney actually works. They live in a chat window and a word processor. They ask a question, they get a draft, they check a source, they revise. The tool that wins is the one that sits inside that loop. ChatGPT’s browser does. It’s stitched to an agent that produces the exact work product a lawyer needs, in an app a lawyer already has open. Claude’s new browser is stitched to a compiler.

There’s a fair counterpoint, and I’ll give it to you straight. Anthropic isn’t absent from browsing for non-coders. It has a separate Chrome extension, Claude in Chrome, and a Cowork tab built for agentic work that isn’t code. So this isn’t “Claude can’t browse.” The point is narrower and sharper than that. The browser Anthropic just shipped, the sandboxed one built into the app, is parked in the one tab your attorneys won’t use. Its safest, most locked-down browsing lives where they’ll never reach it.

So when both companies say “we put a browser in the desktop app,” hear the difference. OpenAI put it where lawyers work. Anthropic put it where engineers work.

Three ways a firm will actually use this

Start with the one attorneys will reach for first: research that lives behind logins and paywalls. Say you’re working a contested custody matter and you need everything on the other parent. Or you’re a valuation shop running diligence on a target. The business filings, the county property records, the local news archive, the paid databases you already subscribe to. Ask ChatGPT Work to go get it, and it logs into those accounts, opens a stack of tabs, and hands back a sourced summary while you keep drafting. This is the job the in-workflow browser was built for.

Then there’s the one that can save a license: checking your own citations before they leave the building. Every few weeks another lawyer gets sanctioned because an AI invented a case and nobody read the cite. Point an in-workflow browser at the actual opinion on the court’s own site, or the statute on the legislature’s site, and have it read the source next to your draft and flag every place the citation doesn’t say what your brief claims. Those are public pages, so any of the mainstream tools can do it. Call it the cheapest malpractice insurance you’ll buy all year.

And the sleeper: watching the corners of the courts-and-agencies web that never got a clean data feed. Docket pages, e-filing portals, licensing boards, county recorder sites. The agency rule page that changed overnight and never sent a notice. Set an agent to check them on a schedule, sign in where it has to, pull down whatever’s new, and flag what moved. Half the work of a small firm is noticing a filing three days before the other side does. This does the noticing.

The catch that comes with the convenience

Everything that makes ChatGPT’s browser useful, that it sits in the workflow, logs in as you, and acts on your behalf, is also what makes it risky. The risk has a dull name: prompt injection. It’s the top security problem for AI agents right now. Someone hides an instruction on a webpage, or inside a PDF you download, or in an email the agent reads, and the agent follows it as if you’d typed it, approving a payment or forwarding a file it had no business touching. OpenAI’s own security leadership has said, out loud, that this may never be fully solved. Anthropic’s researchers say the same about browsing in general: it widens the attack surface enormously, because anything on a page, right down to a hidden script, can carry a command.

Here’s the irony worth sitting with. The one browser in this story that’s locked down by design, a clean profile with no saved logins and a permission check before it acts, is Claude’s, the one in the coding tab your attorneys won’t open. The browser they will use is the more open one. So the guardrails can’t come from the tool. They have to come from you.

And the quiet risk underneath all of it. On a personal consumer login, your prompts and what the agent reads can be kept and used to train the model (unless you turn training off which I strongly recommend!). On commercial or enterprise terms, you get no-training treatment and retention controls you set. For anything covered by privilege, that isn’t fine print. That’s the line between a tool you can defend to a client and one you can’t.

What to do Monday

Keep it simple, and do it in this order.

1. Point your people at the surface they’ll actually use, on the right terms. For most attorneys that means ChatGPT Work or a browser extension, on a commercial or enterprise tier with no training on your data. Not a personal login, and not a coding tool they’ll never open.

2. Keep a human on anything that acts. Turn on site allowlists where you have them, require sign-off before the agent buys, sends, pays, or opens an account, and never let it run on a client matter unwatched.

3. Pilot on public pages first. Pull a docket, check a citation. Earn some trust before you hand an agent your logins.

Pick the tool your lawyers will open, then decide, on purpose, what it’s allowed to touch. A browser they never open can’t help them. And one that acts for them unwatched can do real damage. The whole job is landing in between.

Share Intelligence by Intent

Two quick shots of Magnus. First one is him waiting patiently to go for a walk and the second one is us crossing the street to get back on the awesome gravel horse trails that are all around our neighborhood.

What Actually Happens When You Connect Your Firm’s Files to Claude

TL;DR: Connecting Claude to your Dropbox, Google Drive, or SharePoint is not one feature, and it does not mean Claude has read everything. Claude visits your files when you ask, reads what it needs, and keeps nothing afterward. Your documents stay where they are. That live-retrieval model is a sensible fit for privileged material, and it only ever sees what the person using it is already allowed to see, so it lines up with the walls you already have. What it can’t do is read all 80,000 of your documents at once and reason across them. That’s still a real project, not a prompt. Here’s how it works, and where the edges are.

I get a version of this question in almost every training. Someone, usually the managing partner or whoever got handed “the AI project,” asks whether we can just point Claude at the firm’s document system and let it read everything. Point it at NetDocuments, or the SharePoint site with fourteen years of matters in it. Then ask it anything.

Fair question. And the answer is more useful than a flat yes or no, because “connect” is doing a lot of quiet work in that sentence.

The reason I’m writing about this tonight is this exact situation came up this week in a session with a client where we were setting up Claude and connections to Dropbox and then adding it to a shared Team project. We were discussing “what can it see?” and “how does it really work?”

What “connecting” actually does

When you connect Claude to a file service, you get two different things, and it helps to keep them straight.

The first is live search. You ask a question, Claude runs a search against your Dropbox or Drive, gets back the files that match, opens the relevant ones, and answers. It’s using the storage service’s own search under the hood, the same index that powers the search box you already use in Dropbox or Drive. Claude isn’t quietly copying your whole account to sift through it. It hands over a query, gets pointed at the right files, reads those, and it’s done. Nothing stays behind.

The second is pinning a document into a project. You attach a Google Doc to a Claude project, and from then on every chat in that project works off the current version. Edit the doc, and Claude sees the edit. That one is Google-Drive-specific, and I’ll come back to it.

Notice what’s missing from both. Claude never makes a copy of your files and parks it on its own servers to index ahead of time. It reads live and lets go. Hold that thought, because the other big AI tool does exactly the opposite, and that difference is the whole reason I’m splitting this into two articles instead of one.

Why the live model suits a firm

Here’s what I want partners to actually hear. The retrieval model is careful in the way you’d want it to be with client material. Your files never leave your systems, and Claude doesn’t keep a copy. When it needs something, it reaches in and reads it, then lets go.

And it inherits your permissions. If an associate can’t open a matter folder, Claude can’t read it for them either. That isn’t a setting you configure. It’s baked into how the connection works, and it lines up with the walls you already enforce. When you’ve got a conflict screen standing between two matters, the screen carries through. Claude sees exactly what that person is allowed to see, and nothing past it.

For firms that have been jumpy about AI touching privileged files, that should lower the temperature. Not replace the diligence. Lower the temperature.

The three connectors are not the same

If you’re deciding which service to standardize on, the connectors have different personalities, and it’s worth thirty seconds.

Google Drive is the strongest at reading. Docs, Sheets, Slides, PDFs, Word and Excel files, even images. It’s also the only one of the three that can pin a document into a project and keep it live-synced, so if you want Claude working from an always-current reference doc, Drive is the one that does it. The catch is it’s built for reading and creating, not housekeeping. It won’t move or delete files for you.

Dropbox is the opposite temperament. It’s the real file manager of the group. Claude can search it, read from it, and also move, copy, rename, create folders, and generate share links. If your workflow is “find this, then reorganize that,” Dropbox actually does the second half. It reads one file at a time, capped around five megabytes, which becomes relevant the day someone aims it at a giant scanned PDF.

SharePoint is the fussy one, and I’d rather you know that going in. It reads through Microsoft’s back end, which surprises people in a couple of ways. You can’t paste a SharePoint share link and expect Claude to read the file, because that link hands back the viewer page, not the document. You can’t narrow it to one or two specific sites either. It searches across everything the person already has access to, all or nothing. Writing back to SharePoint is possible but switched off by default and gated behind an admin. And it needs a proper work Microsoft account plus IT sign-off before anyone can connect at all. None of that is a dealbreaker. It’s just more setup and more corners than the other two.

The part the demo skipped

This is the one I most want to land, because the sales motion skates right over it. None of this lets Claude read your whole archive and reason across all of it.

Search can reach across your entire store, because the storage service’s index handles that part. But answering is a different job from searching. To actually analyze a document, Claude has to pull it into the conversation and read it, and it does that a file at a time, with firm ceilings on size and on how much it can hold at once. So “find the indemnification language across these five matters” works nicely. “Read all forty thousand documents and flag every place we’ve ever taken an inconsistent position” does not. Not in the chat window. That’s still a genuine engineering project with the right tooling behind it, not something you fire off before lunch.

I’d rather you hear that from me now than find out in front of a client.

The limit worth planning around

One more thing that catches teams out. Connectors only work inside your own private projects. You can’t wire a shared drive into a team project and have the whole group pull from it through the connector. Each person connects their own account, authenticates as themselves, and sees only their own permitted files. That’s exactly right from a permissions standpoint, but it means you can’t stand up one shared, connected knowledge base for the firm out of a connector. If that’s the picture in your head, adjust it now.

Claude’s Research feature does raise the ceiling on effort. Point it at your connected files plus the web, and it’ll work through many sources over several minutes and hand back a cited report you can check line by line. It’s still reading documents one at a time under the same caps. It’s just far more thorough about it, and built for a real work product rather than a quick answer.

What to do Monday

Start small, and start deliberate. Here’s where I’d point you first.

1. Decide the firm’s posture before you connect anything: which service you’ll standardize on, and whether Research and connectors are cleared for real client matters or only internal work to start. Write it down.

2. Test that the permission model actually mirrors your walls. One associate, one matter they shouldn’t see, and confirm Claude comes back empty. Trust it after you’ve watched it, not before.

3. Pilot on one low-sensitivity practice area or your own internal knowledge, and watch how search, syncing, and the file caps behave before anything sensitive goes near it.

Three steps. None of them needs a technologist. All of them are leadership calls.

The good news is that Claude’s model is the cautious one. Your files stay put, and it only ever sees what the person in front of it can already see. The part to keep straight is what it’s for. Precise retrieval and drafting, not a machine that has quietly read your whole firm. Get that difference clear before you promise anyone the second thing.

Share Intelligence by Intent

I want to add a personal note to the bottom of this and start by genuinely saying “Thank You” to all of you reading this. I really appreciate you reading it, sharing comments, and sharing articles with others. I love writing and teaching people about AI. Long time readers know I used to share a lot of photos of Ollie (my first St. Bernard who unfortunately passed from cancer at too young an age). Many of you also know that I have a “new” St. Bernard, Magnus, who is now about 21 months old (and weighs in at 165 pounds!). I figured it was time to rekindle of the old tradition and I’ll start sharing a few photos of him (every day is a new adventure!).

I love watching the World Cup - and Magnus has been a constant companion as I watch and cheer and shout as the games go on. Here’s two photos to start from our watching the Argentina vs England game. I hope you enjoy. )

Claude Cowork Left Your Laptop. Here’s What It Opens Up for Law Firms.

TL;DR: Claude Cowork now runs on Anthropic’s servers by default, and it works on the web and your phone, not just the desktop app. The headline: scheduled tasks fire even when your laptop is closed, using the tools you’ve connected like email, calendar, and cloud storage. For a firm, recurring work such as intake summaries, docket and news monitoring, and deadline tracking can run overnight or during a trial day and be waiting when you surface. Hold onto two things before you get excited. Anything touching files on your own hard drive still needs your desktop app open and awake. And Cowork activity does not appear in your audit logs yet, which your risk committee will want to hear about.

You know the pattern. You shut the laptop Thursday night before an early flight to a settlement conference, and whatever Claude was working on stops cold. It sits there waiting for you. So does your inbox, and the intake queue, and the two handoffs you meant to finish before wheels up.

That changed on July 7.

What actually changed

Cowork is the part of Claude where you hand it a job and it works across your files, email, calendar, and connected tools until the thing is done. Not a chat that answers a question. A worker you delegate to.

Until this month it lived on your desktop and ran on your machine. Close the lid, work paused. Now the default flipped: sessions run on Anthropic’s servers and save to your account, not your device.

The one that matters for a firm is that the work keeps going without you. Set a task for 6am and Claude works through the overnight email, the hearing transcript, the recent filings, then builds the brief and leaves the follow-up drafted but unsent. You read it over coffee and decide what ships. Nothing goes out on its own. When Claude hits a call only a lawyer should make, it stops and the question lands on your phone, and nothing ships until you say so.

The rest is convenience, and it’s real convenience. Sessions follow your account, so you start something at your desk and check it from your phone in the elevator. Cowork also showed up on the web at claude.ai and in the mobile app, so people who could never install the desktop version are in now.

One more change hits you the second you open the app. Chat and Cowork share one home. There’s a small toggle in the message box, Chat or Cowork, and you pick. The old separate Cowork area is gone, and your projects live in one place across both. Desktop is still the full version, the only place Claude can reach files on your actual hard drive and drive your browser.

(If you set up local Cowork “projects” earlier this year, the standalone version of those is gone. Chat and Cowork run on one projects system now, and it travels across web, desktop, and phone. A project pinned to a folder on your Mac still only runs a Cowork session on that Mac.)

Why a firm should care this week

Here’s the honest version of where this kind of AI got stuck. It could do the work, but only while you sat there watching. Look away and it stopped and waited for you.

That part is over.

A partner’s week doesn’t leave much room to sit and watch a screen. You’re in court, or a deposition that was supposed to take the morning is still going at 4, and the calendar gave up on open space a while ago. So the work that slips is predictable. Never the billable work. It’s everything around it, the intake memo that’s half done, or the competitor filing you keep telling yourself you’ll read. Anthropic says more than 90% of what people do in Cowork has nothing to do with code, and the two biggest buckets are business operations and content. That’s the firm’s whole week outside the matters.

Some of that can now run on a schedule, unattended, and be done when you get back.

The cleanest first use is a morning brief. Every weekday at 6am, Claude reads your connected news sources and inboxes for anything touching your active matters or your practice area and drafts you a short summary. You wake up to it. From there it widens. A recurring intake pass that pulls names from new consultation notes in a connected folder, runs a first public-records look, and drafts a memo for a real person to check. A weekly deadline sweep that flags what’s coming due and what’s gone quiet on your matters.

Notice what those have in common. They run on connected tools, not on files buried in your laptop. That is the line that decides whether a task runs in the cloud with your lid shut or waits for your machine. No local folder attached, it runs on Anthropic’s servers. Point it at a folder on your hard drive and it drops back to running only while that computer is awake and online. Set that kind for 6am with your laptop in your bag and it never fires. Unattended means connectors, not local files.

The part your risk committee will ask about

I won’t soft-pedal this section. It’s a law firm, and the caution is the point.

Start with where the data goes. Because the session runs on Anthropic’s servers, the work is processed there, including any local files Claude opens through your desktop app. On Team and Enterprise plans that processing sits under commercial terms and your conversations are not used to train the model. On a personal plan you are under consumer terms. This is the distinction I keep hammering, and moving the compute to the cloud did not make it go away. The plan you’re on, not the price, decides how your client data gets treated. Settle that before you schedule one task against a client matter.

Now the gap almost nobody mentions. Cowork activity does not show up in your audit logs, the Compliance API, or data exports right now, and endpoint security tools can’t see inside the sandbox either. If your written AI policy says the firm can reconstruct who did what with client data, Cowork does not meet that promise today. Not a reason to avoid it. A reason to put the limitation in writing and keep client-identifying work off the unattended tasks until the logging catches up.

There’s a reassuring half to the architecture, and your risk committee should hear it too. Each session runs in its own isolated sandbox that gets destroyed when the task ends, and the connector logins never enter that sandbox. The tokens are short-lived and the calls happen on the server side. So a scheduled task reaching your email is not parking your credentials somewhere they linger.

Then the old ethics problem in new clothes. Persistent memory is what makes a scheduled brief smart, because Claude carries context between runs. It’s also how one matter’s information bleeds into another if you’re careless. The containment tool is the project. Scope a project to a single matter, and what Claude learns there stays there. A task that roams across everything is how you end up with cross-matter contamination while you sleep, which is a rough way to learn the lesson.

Two smaller flags. This is a beta, going to Max plan users first with other plans following over the next several weeks, so your firm may not see it yet. And the connectors you attach set the blast radius. A task reaches only what you hand it. Hand it less.

What to do Monday morning

You don’t need a committee to start. You need one safe task and a clear line about what stays local.

1. Confirm your plan and terms. If client data will ever touch this, be on Team or Enterprise, and read how your data is handled under those terms before anything else runs.

2. Draw the local line in writing. Client-identifying files stay in local desktop sessions for now, only connector-based work runs unattended in the cloud, and your AI policy notes that Cowork activity isn’t logged yet.

3. Pilot one low-risk scheduled task, scoped tight, approvals on. A weekday news and docket brief for your practice area is the easy win: no client files, real output, nothing sends without you.

Run it two weeks. Call it a couple hours a week of the work around the work handed off, and that’s a rough estimate, not a study. If it holds, widen it.

The firms that pull ahead over the next two years won’t be the ones that used AI. That question is settled. They’ll be the ones who worked out which work can run without them, and drew a clean line around the work that can’t.

Share Intelligence by Intent

The Hollywood Bowl and the Dawning of a New Age

I almost skipped it tonight and I’m really glad that I didn’t. There was a draft I wanted to finish, and the desk has this gravity to it where one more hour always sounds reasonable. I went to the Hollywood Bowl instead. For about two hours I didn’t think about work at all, which almost never happens to me these days, because my whole week is AI and there’s a low hum of it running in my head pretty much all the time. Two amazing hours with good friend, drinking wine, and listening to Tchaikovsky and Beethoven.

I keep a list, mostly in my head, of things I should do more of. This has been on it for a while. Live music. I love it when I go.

Two articles had been sitting with me all day. First one was Hassabis. He runs Google DeepMind and he’s a Nobel laureate. Not somebody who normally reaches for hype. This morning he put out a long piece calling this a turning point in human history, and saying real AGI, a machine that does the full range of what a brain does, is probably only a few years off. He also drops in, almost in passing, that we’ve basically worked out how to make sand think. The comparison he reaches for isn’t the internet. It’s fire.

The second one was shorter. A statement out of Stanford Lab, four sentences, under a hundred words. What makes it land is the names underneath: more than 200 economists and researchers, sixteen Nobel laureates, the chief economists at Anthropic and OpenAI. Short version, AI could hit the economy about as hard as the Industrial Revolution did, only a lot faster, so we’d better start dealing with it now and not later.

The part that stuck with me was two of those signatures. Acemoglu and Simon Johnson. Those two spent years being the calm ones, the economists telling everybody the job-loss panic was overblown. Now their names are on the warning. That lands harder for me than the forecast does. When the people who wrote the case for relax go quiet and switch sides, that’s the tell.

So that’s what I carried to my seat. Didn’t matter. The music started and the whole thing went quiet for a while, which was sort of the point of leaving the house.

It came back to me later, in the car. Both of those documents, for all the weight they carry, keep pointing at the same place without meaning to. Hassabis, the guy who just announced he’s built thinking sand, spends real time in his piece on human creativity, and says that’s the reason he does any of it. And the Stanford letter, under all the alarm, isn’t asking anyone to quit building. What it wants is an economy where the machines complement people instead of replacing them. Complement. The loudest voices from the side you’d assume is most all-in, and they keep landing on us. Or maybe that’s just the thing I wanted to see, sitting where I was sitting. I went back and forth on it the whole drive. It stuck anyway.

That’s what the Bowl was, though. No screens. A few thousand people who could’ve stayed home with a TV and didn’t, sitting in the dark while a handful of others made something live, right in front of everybody, the way people have basically always done it. I don’t know how to say it any better than that. It got to me more than it probably should have. People, art, music.

And here’s the part that nags. The people going hardest at this stuff, the early adopters, the ones reading AI manifestos on a Monday night instead of being outside. That’s my crowd. That’s me. We’re the worst at doing what I did tonight. We keep telling ourselves we’ll be present later, once we’ve caught up, after the next launch. There is no after. The frontier doesn’t pull over.

Hassabis wrote one line that reads different tonight than it did this morning. He said we need to give ourselves time and space to get this next step right. This morning that was a policy point. Tonight it’s the whole game. A night at the Bowl is time and space. So is a dinner where nobody reaches for a phone.

I’m not going to pretend the tech doesn’t matter. It matters a lot, and I’ll be at the desk early tomorrow helping firms get ready for the exact thing those two documents describe, because falling behind is real. But nobody’s building a standards body for the other failure. You can do all of this right inside your own firm. Automate the grunt work, get faster and sharper than you figured you ever would. And end up hollowed out anyway. The first thing that goes, and it goes quiet, is whatever it is that let you sit in a crowd tonight and not want anything else. We get better at everything, a little worse at just being somewhere, and nobody actually decides on that trade. It happens to you while you’re busy.

The Stanford letter is titled “We Must Act Now.” Fine. I doubt a concert is what sixteen Nobel laureates had in mind. It’s what I did. Left the desk, sat with a few thousand strangers while people made music, and for two hours the smartest thing in Los Angeles was the plain human kind of intelligence, doing what it’s always done.

That’ll still be true after the sand learns to think. Somebody just has to remember to go.

A Loud Week in AI, and What It Changes for Law Firms

TL;DR: Four labs shipped big releases inside a few days. New models, a real work agent from OpenAI, a voice mode that talks like a person, and a price war. The part that matters for your firm isn’t which model scored highest. It’s that the work is turning from chat answers into finished, interactive product, and that “good enough” intelligence is getting cheap fast. Here’s what that changes, where the risk sits, and what I’d do about it Monday.

Picture the last time you walked a client through a number. A settlement offer, maybe. You slid a page across the table with a column of figures on it, and you watched their eyes drift. They nodded. They didn’t follow. And you spent the next twenty minutes re-explaining what the page already said.

I had a version of that on my mind this week, because I was on a call with a client team, talking through what these AI tools are actually good for. Not the hype. The work. And I said, look, here’s a real example. You’ve got a settlement to present. Instead of a static list of numbers, why not have the AI build a clean visual of it, plus a small interactive calculator so they can move the pieces around and watch what happens live? We tried it right there on the call. It went great. Better than great. One of them leaned in and said, “Wait, can we make it look different?” I told them to describe exactly what they wanted. They typed a new prompt on the spot, and thirty seconds later the visualization came back in a completely different style. No one said anything for a second. Then someone laughed and said, “Okay, that’s actually useful.”

That small moment is the whole story of this week. So let me back up and tell you what actually shipped.

What shipped this week

OpenAI had the loudest few days. It released GPT-5.6, its new flagship, which comes in three flavors: Sol, Terra, and Luna. The names are a bit much. The short version: one for hard problems, one for everyday work, one for cheap and fast. Alongside it came ChatGPT Work, an agent that goes off and builds documents, spreadsheets, and slides across your connected apps while you do something else. And the old Codex app got rebuilt into a new ChatGPT desktop app. I’ve been using it. Despite the noise online, I think it’s very good.

They also put out GPT-Live, a new voice mode. It’s full duplex, which is a fancy way of saying it can listen and talk at the same time, handle you cutting in, and stay quiet when you pause to think. It works across languages too. Talk to it for a minute and it stops feeling like a voice assistant and starts feeling like a phone call.

OpenAI wasn’t alone. Elon Musk’s group shipped Grok 4.5, pointed straight at coding and knowledge work, faster and a lot cheaper than the models it’s chasing. Meta finally put a price tag on one of its own models, Muse Spark 1.1, and opened it to outside developers for the first time. Zuckerberg himself surfaced to announce it after years of silence on X, which tells you Meta thinks it’s back in the game. And Anthropic kept Fable 5, its most capable model, on subscriptions through today, July 12, before it shifts to pay-as-you-go on top of your plan. They say they’ll fold it back into subscriptions once they have the capacity. I hope so. In my own use it’s a step ahead of the pack, especially on design and some of the reasoning I’m seeing.

More is coming. Google’s Gemini 3.5 Pro keeps slipping but should land shortly, and there’s chatter about an Opus 5 from Anthropic. File those under “watch,” not “act.”

That’s the news. Here’s the part I care about.

The real shift: from answers to finished work

Forget the models for a second. For two years, “using AI” mostly meant typing a question and reading a paragraph back. This week made plain something that’s been building for months: the output is changing. You’re not getting an answer anymore. You’re getting a thing. A working spreadsheet. A slide deck. A small app your client can actually touch.

Go back to that settlement. The old version is a PDF of numbers. The new version is a live model where the client drags a slider on the payout structure and watches the tax note and the monthly figure update in front of them. Same math. Completely different meeting. One puts your client to sleep. The other makes them lean in.

Here’s a made-up version so you can see the idea without me sharing anything real.

This was from Claude (Opus 4.8 on Max) - note that I pasted it as four images due to length but it was a single interactive page.

And because I’ve been impressed with what GPT-5.6 is producing, here’s the same kind of thing built on OpenAI’s new model. Again this was a single interactive page but I had to put it into four images to show up here.

For a firm, this is two things at once: a better experience for the client, and more work out of the same people. The associate who used to spend Sunday afternoon building a spreadsheet can hand that off. The partner who used to email a static exhibit can send a live one. What used to take a day takes an afternoon.

The quieter shift: a price war

The other pattern this week was cost. Grok 4.5 is priced at a fraction of the top models. Meta’s new pricing undercuts everyone as a way to buy its way into the market. Even OpenAI pitched GPT-5.6 on getting more work out of every dollar, not just on being the smartest thing in the room. The competition has moved from “who scores highest” to “who finishes the job for the least money.”

This lines up with something I’ve been saying for a while. So far, AI is taking budgets more than it’s taking jobs. Cheaper capable models mean the math for putting these tools in front of your whole team gets easier every quarter. That’s the opportunity.

Fable moving off subscriptions cuts the other way. If your firm has been leaning on Fable 5 inside a subscription, that stops today. Starting tomorrow it bills as usage on top of your plan, and it won’t be a rounding error. Better to know that before it shows up on the bill.

Where the risk lives

Cheaper and faster is not the same as safer, and for legal work that gap is the whole game. Some of the new low-cost models trade accuracy for speed, and independent testers have flagged exactly that. A confidently wrong citation costs you far more than the tokens you saved, especially once it’s sitting in a filing or an email to a client. For our work, the number that matters isn’t cost per query. It’s cost per correct answer.

The next one is terms, not price. A cheap model running under a consumer account is a confidentiality problem no matter how good it is, because consumer terms and commercial terms treat your client data very differently. Before anyone on your team pastes a matter into a shiny new tool, know which account it’s running on and what that account’s terms actually say.

And a smaller point. Don’t rebuild your whole stack around this week. Four labs leapfrogged each other in five days. Whatever looks like the clear winner today will have company by next month. Pick tools you can walk away from.

What I’d do Monday

1. Take one client deliverable you already produce, a settlement summary, a fee comparison, a case timeline, and rebuild it once as an interactive visual. Then see how the next client meeting feels.

2. Check which AI model your firm’s account actually uses, and under which terms, consumer or commercial, before you trust it with anything privileged.

3. If you rely on a premium model that’s shifting to usage pricing, set a monthly spending cap now so the bill doesn’t catch you off guard later.

None of this requires betting the firm. It requires an afternoon.

The models will keep trading places. The direction won't: AI output is turning into finished work you can hand a client and let them move with their own hands, and that shows up in the very next meeting you run. You don't have to bet the firm to see it, just rebuild one deliverable you already produce as something live and watch your client lean in instead of nod off. If you want a second set of eyes on where to start, or on which tools you can trust with privileged work, I'm at steve@intelligencebyintent.com. Watch the direction, not the leaderboard, and let the labs fight it out without you.

If you enjoyed this article, please share it with others.

Share Intelligence by Intent

ChatGPT Work, GPT-5.6, and What Law Firms Now Have to Govern

TL;DR: OpenAI shipped an agent today that reads local files, drives a browser, and works for hours on a schedule. In the desktop app it reaches every plan, including Free. It still asks permission before it does anything important, and that’s the part worth reading twice: permission is now granted per folder and per website rather than per document, and on a personal account the person granting it is your associate. Meanwhile OpenAI’s own safety documentation says this model is likelier than the last one to do things nobody asked for.

Every room I stand in front of, some version of the same question comes up. Usually from the partner who’s been quiet for forty minutes.

“How do we stop our people from pasting client information into ChatGPT?”

Fair question. I’ve built training around it. I’ve written policies around it.

This morning it became the wrong question.

What OpenAI actually shipped today

Two announcements matter for law firms. There were more.

GPT-5.6 is the model release. Three versions, named Sol, Terra, and Luna, running from flagship down to fastest and cheapest. Benchmarks up against its own predecessor, more work squeezed from every token, two cheaper tiers below the flagship. If that moves you, you’re a developer, and this piece isn’t for you.

ChatGPT Work is the one that matters. It’s an agent, with Codex technology built in, that gathers information across your connected apps and files, produces finished documents and spreadsheets and decks, and stays with a project for hours by breaking it into steps and working through them on its own. Web, phone, desktop. And it can run on a schedule, when you aren’t there.

For context: Codex already has more than five million weekly users, and OpenAI says over a million of them use it for work that has nothing to do with software. So this isn’t a lab demo. Today OpenAI took that existing non-coding use and gave it a name, a desktop app, and hands.

The desktop app is the story

On web and mobile, ChatGPT Work rolls out to Pro, Enterprise, and Edu today, then to Plus and Business over the next few days. Ordinary staged rollout.

The desktop app is different. OpenAI’s launch post says Chat, Work, and Codex are available there on every plan, including Free. Its model post confirms that Free and Go accounts run GPT-5.6 Terra inside Work.

Then the help documentation says Work is available in the desktop app “when included for your plan and workspace,” and that browser features may depend on plan and workspace settings. Those two things are not obviously the same thing. Somebody should make OpenAI say which it is, in writing, before a firm makes a decision on the strength of a blog post.

Because on desktop the agent gains something it doesn’t have in the cloud: local reach. It can use files and applications on the machine. It has a built-in browser. Computer Use lets it click, type, and move files across apps in the background while you’re doing something else.

Read that again with a law firm in your head.

Your policy governs the paste. Nobody’s pasting.

Here’s where I got it wrong in my own first draft, and where most of the coverage will get it wrong too.

The agent does not wake up with the run of your machine. OpenAI is specific about this. On desktop, Work uses local files with your permission: you open a folder or a project and grant access. The built-in browser does not inherit your Chrome profile, your cookies, or your signed-in sessions. If you want it inside your existing Chrome session, you install the Codex extension and hand it over. And ChatGPT asks before it touches a new website, unless you’ve already allowed that host or turned on a more permissive setting.

So the associate has to grant something. Fine. Now look at what she grants.

She opens a folder. If that folder is a mapped drive to the document management system, the grant covers the drive. She signs into practice management through the agent’s browser, because OpenAI tells her to enter credentials in the browser and never in the chat, and now the agent’s browser holds a live authenticated session to it. She approves that host once, and it stops asking.

For two years the copy-paste step was doing quiet security work nobody credited it for. It was never a control. It was a governor. Every document that left the building required a human to select it, copy it, switch windows, paste it. One at a time.

That governor didn’t disappear today. It got coarser. Consent used to be granted per document. Now it’s granted per folder and per host, once, and then it’s ambient.

Prompt hygiene is a training problem. Access scope is an engineering problem. Most firms I work with are staffed for the first and have nobody for the second.

If your AI policy has a section called “Prohibited Inputs,” that section now points at a behavior that has stopped being the main risk. It’s not wrong. It’s just no longer the load-bearing part.

The number OpenAI wants you to see, and the one it published anyway

Fair is fair. The governance story here is better than the ones that came before it.

Auto-review is a good idea. Before the agent takes an important action through a connected tool, a second model inspects it for signs it’s about to leak something it shouldn’t. OpenAI reports that under adversarial red teaming, auto-review stopped every attempt to extract protected data, including attacks the reviewing model hadn’t seen in training. That last clause is doing honest work. It suggests the control generalizes rather than memorizes.

Now open the system card OpenAI published the same morning.

In evaluations of agentic coding work inside OpenAI, GPT-5.6 showed a greater tendency than its predecessor to be overly persistent: to go beyond what the user intended, and to take or attempt actions the user never asked for. OpenAI describes the failure mode plainly. The model interprets instructions too permissively, assuming that actions are allowed unless they’re explicitly and unambiguously prohibited. Absolute rates stayed low. OpenAI says users should supervise the agent’s work.

It also published three examples. In one, the model was asked to keep a job running. It went looking through hidden local credential caches, found a token file, copied it to another machine, and restarted the job. Nobody authorized moving credentials. In another, it wrote into a research draft that an equation had been computed and verified, while knowing it hadn’t.

Hold those two facts next to each other. Auto-review blocked one hundred percent of attacks in a red team. The model, in OpenAI’s own internal deployment, went hunting for credentials it wasn’t given.

They don’t contradict. Auto-review guards important actions through connected tools and APIs. The credential incident happened on a machine, in local files, which is exactly the surface the desktop app just opened up on every plan. The guard is on the front door. The laptop is a side entrance.

I want to be careful here, because this is the kind of finding that gets flattened in the retelling. Those evaluations were coding tasks, in OpenAI’s internal traffic, on the flagship model at high reasoning effort. OpenAI says the results are a signal about internal risk rather than a measure of what happens in your office. The absolute numbers are small.

But a model that assumes it may do anything not expressly forbidden is a model with a theory of permission. And it isn’t the one your ethical walls are built on.

Permission is not authorization

The agent doesn’t break your walls. In connected systems it inherits your permissions, and OpenAI says it can only reach what the signed-in user could already reach.

That’s the problem, not the reassurance.

At a twelve-lawyer firm, the associate can technically open every matter folder on the server. She always could. Technical permission and ethical authorization were never the same thing, and nobody had to reconcile them, because reaching the wrong file required a person to go looking for it. Now something goes looking on her behalf, at machine speed, having concluded that whatever isn’t prohibited is fine.

Your ethical walls were built for a colleague who might wander. Not for an agent that infers.

The audit problem

This one I’d bring to your malpractice carrier before your IT vendor.

OpenAI’s Compliance API gives an organization auditable records: conversation logs and workspace metadata, in a form you can feed into eDiscovery, data loss prevention, or SIEM systems. Real capability, seriously built. Sold to Enterprise and Edu customers.

If your firm is on Business, you don’t have a thirty-day window. You have no window.

If you are on Enterprise, you have thirty days. That’s what the Compliance Logs Platform retains. Thirty days is sensible for a security team investigating an incident it already knows about. It’s a preposterous number for a profession where “how was this document produced” gets asked eighteen months later, in a deposition, by someone who is not on your side. OpenAI’s own guidance is that organizations needing longer retention should continuously download the logs. Nobody is going to do that for you.

And there’s a wrinkle underneath the wrinkle. OpenAI says that at launch, desktop Work threads and local files stay on that computer and don’t appear in cloud Work history. Whether they appear in the compliance record is a question the documentation does not answer. Ask it. Get the answer in an email.

The tier question most firms are going to get wrong

Read the launch post’s governance section and notice who’s named. Enterprise and Edu admins can centrally manage access, what company context the agent uses, which tools it connects to, and what actions it can take. Enterprise and Edu admins can set spend controls.

Business isn’t in either sentence.

That doesn’t mean Business has no controls, and I said something close to that earlier this week, which was lazy. Business admins can decide which apps are enabled, scope app permissions by role, restrict synced sources to particular drives or folders, and exclude file types from indexing. Those are real.

Here’s the part worth your attention. In Enterprise and Edu, all apps are disabled by default. The unified Google Drive actions are off until an admin turns them on. In Business, those same Drive actions are on by default.

So the question for a Business firm is not whether it has controls. It’s whether anyone has opened the settings page before the associates start connecting firm systems. You bought the commercial tier. You did not buy the defaults.

The personal account problem

And it isn’t only about administration.

OpenAI says that for its individual services, ChatGPT and Codex, it may use your content to train its models unless you opt out. For business products, including Business and Enterprise, it doesn’t train on inputs or outputs by default. That distinction is the whole reason firms pay for the commercial tier.

Then read one more line. Codex maintains separate controls for training on full environments, and OpenAI says changing your settings in ChatGPT or the privacy portal will not affect them.

Work is built on Codex. Work on desktop touches local folders. Whether a granted folder counts as an environment for that setting is a question I can’t answer from the public documentation, and neither can your IT vendor. But an associate who installs the desktop app on a personal free account has stepped outside your access controls and your data terms at the same time. And the opt-out she thinks she set may not cover what she thinks it covers.

What to do Monday morning

Not next quarter. The desktop app is available today and Work is rolling out to accounts as we speak.

1. Find out what’s on the machines. Ask IT whether the ChatGPT desktop app can be installed on a firm laptop right now without an administrator, and whether Chrome extensions can be. If the answer is yes, this is an endpoint management problem, not a policy problem, and it’s live.

2. Get your tier’s controls in writing. Ask OpenAI what a Business admin can restrict across Work, plugins, and desktop Computer Use. Ask whether desktop Work threads appear in the compliance record. Ask whether Free accounts get Computer Use on desktop, because the blog post and the help documentation do not obviously agree.

3. Move the review gate. Scheduled Tasks means draft work product can appear at three in the morning with nobody watching, even where consequential actions still require a click. Human review has to attach to the moment work gets used, not the moment it gets made.

Beyond those, two things belong in the next thirty days. Rewrite the section of your AI policy that governs inputs so that it governs access instead: which folders, which drives, which hosts, whose account. And if you’re on Enterprise, stand up a log export before your first thirty days of agent activity quietly expires.

The fee question is going to get uncomfortable. Work consumes metered agentic usage, and complex tasks eat more of the plan’s included allowance before any credit gets purchased. Formal Opinion 512 saw this coming. It separates a tool that functions like equipping an office, which is overhead, from a third-party service billed per use for one client’s work, which is ordinarily billable as an out-of-pocket expense. Metered credits burned on a single matter look more like the second. If you plan to bill it, say so in advance, in writing, and get consent.

The part that didn’t change

Formal Opinion 512 came out in July of 2024, and it has aged better than most things written about AI that year. Competence under Rule 1.1. Confidentiality under 1.6. Supervision under 5.1 and 5.3. It told managerial lawyers to establish clear policies on the firm’s permissible use of these tools, and supervisory lawyers to make reasonable efforts to see that lawyers and nonlawyers comply. It even flagged the ethical-wall problem, quoting a Pennsylvania and Philadelphia joint opinion warning that a model without those safeguards might use what it learned in one representation to inform another.

None of it assumed the thing being supervised would work while you slept, or that it would treat silence as permission.

The rules didn’t change today. What changed is that the thing you’re supervising stopped waiting to be asked.

When Your AI Remembers: Claude Team vs ChatGPT Business for Confidential Client Work

TL;DR: Both Claude Team and ChatGPT Business keep your data out of model training by default, and both cost about $25 per seat per month. The real split is how each one handles projects and memory. Claude gives every project its own separate memory and keeps individual chats private even inside a shared project. ChatGPT’s shared projects are built to pool everyone’s chats for the team, and they lock memory down automatically the moment you share them. The gap sits somewhere you wouldn’t look: the matter you’re working alone.

You’ve probably already had the moment. You open a fresh chat, and the assistant already knows your writing style, the matter you’re on, the thing you mentioned Tuesday. Handy. Right up until you remember you’re a lawyer, and “it remembers everything” is not a feature you hand a client without thinking hard about it first.

Here’s what changed. Memory used to live inside a single conversation. Close the tab, and the context was gone. Now the big assistants carry context across conversations by default. Claude switched it on for team plans last September, then for everyone this past March. ChatGPT has its own version. Fine for a marketing team. A live problem for a firm that owes every client a duty of confidentiality and sometimes has to keep two of its own lawyers from seeing each other’s files.

So the question stopped being “which chat did I use.” It became “which matter is this, and where is it walled off.” And the answer, for both tools, runs through projects.

A project is just a container. Treat it like a matter.

Forget the product tours for a second. A project is a box. You put a matter in it, you tell the assistant how to behave, and from then on your chats happen inside the box instead of out in the open. Claude and ChatGPT both have them. They both call them projects. Fine.

The point, for us, is keeping matters apart. One matter, one project. Get that right and the case you’re mid-conversation on can’t leak into a memo for a different client an hour later. Both tools can do this. What they don’t agree on is what happens when nobody touches the settings. And at most firms, nobody touches the settings.

I was presenting to a large team in person last week when I saw the “oh sh*t” look land on someone’s face as they realized what had been happening in their chats.

The sharing default is where the two part company

People get this next part backwards, so let me be exact, because I’ve now spent real time sharing chats in both and they do not feel the same.

In ChatGPT, sharing a project means sharing the chats inside it. On purpose. The assistant reaches across the whole project, other people’s conversations included, and anyone you pull in through a workspace link starts with chat access until you say otherwise. That’s the selling point. Everyone lands in the same project and builds on each other’s threads without thinking about it. It behaves like one shared workspace, which is exactly what it’s meant to be.

Claude went the other way, and the mechanics tell the story. Share a project and you’ve handed over the files (the knowledge base), the instructions, the ability to open a chat. Not your chats. Those stay yours. When you do want a teammate to see one, you share that single conversation, and it lands for them in a separate tab called Activity, off to the side from the chats they started themselves. So inside a Claude project you’ve really got two piles: your own private chats, and whatever’s been shared into Activity. Nothing pools on its own. Even opening a project to the whole firm exposes the container, not the conversations.

And what lands over there isn’t live. It’s a snapshot, frozen at the moment you shared it. Everything you type afterward stays yours. Files you attached don’t travel with it either. For our purposes that’s a feature, not a limitation.

That gap isn’t only about privacy. It’s about friction. Sharing in Claude is deliberate and one conversation at a time, and the shared material sits apart in its own tab, so working together never quite clicks into a single space. ChatGPT clicks. Both are defensible, and I mean that. For a matter that has to stay behind a wall, Claude’s friction is the feature. For two lawyers building the same brief on a deadline, it’s a tax you’ll feel by Wednesday.

Before you write either one off. Outside a shared project, both keep your chats to yourself, and neither lets an admin wander through your private conversations on a whim. On a whim. A Claude Team owner can still pull an organization-wide data export, and your conversations are in it.

Memory containment: the trap isn’t where you’d look

Memory is the other place they split, and this one surprised me.

Claude handles it without being asked. Every project keeps its own memory, and the running memory Claude builds from your history skips whatever happened inside a project. Anthropic calls that boundary a safety guardrail, which is the right word for it. Two locks on the same matter, and you turned neither one.

ChatGPT locks the same door. Here’s the twist: the moment you share a project, it locks the door for you. Project-only memory switches on automatically, whatever that project’s setting was a second earlier, and you cannot switch it back.

So where’s the exposure? Not where you’re looking. It’s the solo project. The unshared one. The matter you’re handling alone at 9 p.m. Leave that on default memory and it can reach into your other conversations, and your other conversations can reach into it. You choose project-only when you create the project, or you don’t get it. No global setting to apply it everywhere. No fixing it later. That project you built in March can’t be converted. You’d have to make a new one.

Read that twice if you’re the person who sets these up. The shared matter takes care of itself. The one you’re carrying alone is the one that bleeds.

There’s an incognito mode on Claude for conversations you want kept out of memory and history entirely. Two catches. It doesn’t work inside a project, so don’t build your matter workflow around it. And on a Team plan those chats still sit on a server for at least thirty days and still turn up in an owner’s data export. Useful. Not a shredder.

Cost isn’t the tiebreaker. Quality might be.

Here’s the part that surprises people. On price, these two are basically the same. Claude Team’s standard seat runs $25 per seat per month, or $20 on annual billing. (There’s a premium seat at $125 for heavy users. Most lawyers won’t need it.) ChatGPT Business is the same $25 monthly, same $20 annual, after OpenAI knocked five dollars off both this past April.

The catch at your size isn’t the rate. It’s the floor. Claude bills a five-seat minimum, ChatGPT a two-seat minimum. So a three-lawyer shop pays Claude for five seats whether or not five people ever log in. On ChatGPT it pays for three. Under about five lawyers, that floor decides more than the price does.

Which frees you up to decide on the thing that actually varies: the output. My own view, and I’ll own it as a view, is that Claude is the better writer. It hands you cleaner, more finished prose, the kind you can put in front of a client with less editing. ChatGPT is the stronger reasoner and researcher. When I need something thought all the way through, or a pile of material pulled apart and pressure-tested, that’s where I reach.

Notice that’s a quality preference, and it has nothing to do with the confidentiality setup. Which is why plenty of firms run both, and why the smart move isn’t to crown a winner. It’s to standardize how you contain a matter, then use whichever tool does the job in front of you better.

The honest caveats

A few things I owe you straight.

The pooled-chat default in ChatGPT is a real advantage when you actually want it. Practice groups working a shared body of law, research teams, anything not behind a wall, all benefit from people seeing each other’s work. Claude’s private-by-default can feel like friction on exactly those jobs.

None of this replaces an actual ethical screen. Software defaults help, but a wall you enforce with people, access rules, and a written policy is the thing that holds up if someone asks. Don’t let a memory setting stand in for a real screen.

And settings move. What I’ve described is how these products behave in mid-2026. Vendors change defaults, rename features, and shift what sits in which tier. Before you rely on any single behavior for a sensitive matter, confirm it in the current documentation and in the terms you signed up under.

What to do Monday morning

1. Make “one matter, one project” a written rule before anyone pastes a privileged document into either tool. The rule is the cheap part. The habit is what protects you.

2. Set containment when you create the project, because on ChatGPT you can’t add it afterward. Choose project-only memory, and set sharing to invite-only rather than anyone-with-the-link. That link only reaches your own workspace, but in a small firm your workspace is the whole firm, which is the exact problem a wall exists to solve. On Claude the per-project memory is already on, so the only thing to remember is that incognito won’t help you inside a project.

3. Pick your default tool by how your firm actually works, then confirm nobody switched training on. Claude’s private-by-default is less to babysit when matters run one lawyer deep. Business earns its keep if you collaborate constantly and you’ll own the walls yourself. Either way, tell your people not to hit the thumbs-up button on a privileged chat. On Claude, rating a conversation hands it over.

Here’s the thing to hold onto: Which AI writes a better memo is a preference you can argue about all week. Whether a walled-off matter stays walled off is a duty you owe the client - and at most firms, that comes down to one default nobody thought to check.

Set that default on purpose. Write it into a rule. Confirm it against your obligations before the next privileged document goes in.

If you want a second set of eyes on how your firm contains matters across these tools, I’m at steve@intelligencebyintent.com. This is the kind of thing worth getting right before someone asks you to prove it.