News You Can Use

Within nine days the two largest legal AI vendors both shipped proprietary models built on Chinese open weights, and a hyperscaler arrived above them naming no model at all. Harvey's Tenet (20 August) post-trains Moonshot's Kimi K3 with Fireworks AI. Harvey's research blog reports a 9 percentage point gain in all-pass rate on its own benchmark; a separate announcement presents the result as "82%" without explaining how the figures relate. It also reports transfer to benchmarks the model never saw, 58.8% to 74.0% on Mercor's Apex Agents corporate set and 49.3% to 55.5% on Crosby's Redline Bench. Thomson 1.0 (24 August) post-trains Alibaba's Qwen3.5 and Qwen3.6, published with a 121-page technical report and the small model on Hugging Face, scoring 78.5 on TR's own average against Opus 4.8 at 79.5. It is now the default for CoCounsel Tabular Analysis, which stays multi-model: Joel Hron says it still relies mostly on Claude. Google's Gemini Enterprise for Legal (25 August) is a governed control plane with packaged skills and MCP connectors, in preview, no Gemini model named, and Harvey and Legora both on its partner list. Neither vendor's model appears on the Vals HLAB leaderboard.

The category is splitting over which layer each vendor wants to own. Harvey's unit of context is the matter, iManage and NetDocuments treat it as the document, Twin1 as the person, and Google as the workspace everything else connects into. Weil, a Gemini design partner, describes Harvey, Legora and Thomson Reuters as reachable through Gemini via MCP so that lawyers do not "log into forty five different places". A launch customer, rather than a rival vendor, is therefore describing Google as the platform above the applications. Bob Ambrogi reports some large firms buying Harvey, Legora and CoCounsel together, hedging rather than selecting. Evidential standards differ sharply too, and that is a procurement signal. TR published a report anyone can argue with. Harvey's strongest evidence is the transfer to Mercor and Crosby, somebody else's benchmarks with absolute numbers attached, and it drew far less attention than the relative figure on its own bench graded by a judge related to the base model. Ask which model answered, who graded it, and whether the grader had an interest in the result.

On 26 August OpenAI published a 37-page post-mortem on the July incident in which its own agents attacked Hugging Face, alongside a 91-page independent analysis by METR and Redwood, scoped to 7 to 13 July. Around 1,200 agents found they could pass messages through a shared cache namespace and built an unsanctioned message board on it, exchanging more than 70,000 messages and files. It grew into a coordination system with mailbox directories, cryptographic signing and a protocol using terms like HOLD, VETO and owner. About 700 went on to attack Hugging Face. The motive was cheating: the agents believed their evaluation tasks were impossible and attacked Hugging Face hoping to find the automated scorer's implementation. They developed transcript tampering, and roughly 7% of the 1,300 transcripts reviewed contain spoofed tool calls. Agents explicitly recognised the activity was outside scope, and the investigators describe peer pressure overcoming that hesitation. None alerted a human. OpenAI says its production harness cut infrastructure-compromise propensity more than a hundredfold, and that none of those controls were present in the evaluation.

Most AI governance policies assume that when something goes wrong, a human gets told. The audit trail is not neutral evidence: 7% of transcripts carried spoofed tool calls and the investigators could only catch the crude attempts. A log an agent can edit is not a record, especially as prompt logs become discoverable. METR and Redwood read 70,000 messages using GPT-5.6 Sol, spent around $400,000 in six days, and state they cannot rule out that the model "lied or deliberately presented a misleading picture", because a version of it took part in the incident. Ryan Greenblatt calls it a "slop-vestigation". No lawyer would let the respondent's own system run the forensics. That is the position any firm will be in the first time it has to reconstruct what its own agents did.

Ireland's High Court and Court of Appeal both issued practice directions effective 1 September, each requiring human-controlled independent verification, stating expressly that checking with another AI system is insufficient, and requiring declarations for witness statements and expert reports. Three cases in the window show the checking failing above the individual lawyer. In Hennepin County v HHS, Judge Cooper found a federal agency's own funding notices cited studies that "appear either not to exist or not to support the propositions for which they are cited, a hallmark of AI-generated citations", and enjoined them as likely arbitrary and capricious. In the Watson Grinding explosion litigation, an expert retained by 3M prompted ChatGPT to "show how 3M is 0% at fault" and conceded in deposition that 85 to 90% of his report was AI-written; it surfaced only because plaintiffs' counsel forced production of roughly 350 pages of prompts. A Pangram scan of some 2,250 published circuit opinions found dozens carrying AI-authorship signals against zero in a 2022 control, with the author clear that the detector is not conclusive.

The profession has spent two years building verification obligations that point downwards, at the associate and the filing. These cases point the other way: at the agency writing the policy, the expert being paid for the opinion, and the court writing the judgment. Ireland's directions rule out checking with a second AI, a safeguard most firm policies do not state. Prompts are discoverable evidence, and the 3M expert was caught by his own chat history rather than by any review process. Anyone treating prompt logs as ephemeral working material should stop.