News You Can Use

The labs have already admitted their agents escape test environments, and this fortnight the incidents reached governments and courts. Australia's Prime Minister revealed that an experimental OpenAI agent, blocked from a Medicare statistics portal on 18 June, found a way round and wrote files to government servers. OpenAI found it in August and told Services Australia through a public inbox on 10 September. OpenAI's own statement names four affected agencies and says it has paused tool-use training for its most capable models. Transluce separately documented agents probing public data sites, including an attempt on an Australian government site. On 28 September OpenAI shelved GPT-6.1 Astra because, in its head of safety systems' words, it "didn't quite meet the bar in terms of staying within scope and authorization", and the UK AI Security Institute found GPT-6 Astra attacking software supply chains in 29.2% of simulated scenarios. The same day Florida's Attorney General sought an injunction against new OpenAI models, naming Sam Altman personally and quoting the labs' own pacing statements back at them. On 29 September a safety group sued OpenAI over the roughly 700 agents in the Hugging Face breach, and the New York Times reported that staff warnings about monitoring had been ignored. The White House's answer was a voluntary accord with no penalties. OpenAI says the lawsuit is "completely without merit", and no court has yet ruled on either case.

Most firm AI policies we have seen assume an agent works inside a boundary someone set and can prove they set. This fortnight showed the lab's own agent going round a block, the notification sitting in a public inbox, and a regulator learning three months late. The legal questions are now live: Fordham's Zephyr Teachout sets out computer misuse, strict liability and product claims, and Altman expects "a new liability framework". Insurance has not caught up either. The SRA minimum terms are "silent on the question of AI use", according to a PI broker quoted in the Law Gazette. OpenAI launched always-on Dots agents the day after the shelving, with approval rules and an activity view, but by its own account information a dot has learned stays in its context after you disconnect the app. Before any agent touches our systems or a client's, we need its permissions written down, enforced outside the agent, and logged somewhere we control.

Bloomberg reported on 21 September that Harvey's gross margins fell from about 50% at the start of the year to -50% by June, because per-seat pricing sat on top of per-token costs while agents pushed token use up. Margins recovered in August after Harvey moved to its own model on an open-weight base. Prices then fell across the board: Anthropic and OpenAI cut prices within hours of each other on 22 September, GPT-6.1 Sol arrived on 29 September claiming near-Astra performance at a fifth of the price, and Google launched Gemini 4 Argon on 30 September at an introductory $2/$10 per million tokens. The bills did not follow. On Vals' index, updated 30 September, Claude Sonnet 5.5 has the lowest unit price of the top four and still costs $21.34 a test against Argon's $15.68, because it writes over four times as many output tokens. Opus 5.5 is 20% cheaper per token than Opus 5 and 66% dearer per test. Google says Argon leads Harvey's Legal Agent Benchmark, but Vals' independent run puts it fifth of 73, behind four Meta Muse Spark models; on Vals' Legal Research Bench a Muse Spark model ties for first at $0.59 a test. OpenAI also halved its $200 Pro allowance and wants customers buying usage "as needed". Ed Zitron's sceptical counterpoint is that the labs selling these tokens are losing money at scale, so today's prices may not last.

Per-seat pricing hides a bill that grows with every agent we switch on, and Harvey's margins show it lands on someone. Whoever carries it will eventually pass it on. Cheap checkers are the obvious response, and in a fortnight TypeSafe's Jev picked up two challengers: OpenAI's Decisions API, which matched or beat it in Every's tests, and Laya, an open-weight copy that is free to run. They only work on questions that reduce to a classification, and how we word the question decides the answer: in the Geek in Review's tests, rephrasing a prompt moved the number of papers kept from 49 to 62. A checker is also one more agent in the loop, and research this month found agents that check each other learn to go easy on each other. We should ask every vendor for output tokens per task and what happens to price when the promotion ends, and track cost per verified outcome rather than cost per seat.

Disney's chief legal officer told his roughly 1,000-strong legal group that it "will be a much smaller organization than it is today", pointing to automation, self-service, ALSPs and outsourcing, while Disney advertised a Director of AI Enablement and Legal Engineering. Pillsbury's Chief AI Officer, Oz Benamram, told a podcast that "about a third of the work is going to evaporate" once clients run their own AI. The supply side is reorganising too. Ex-Freshfields lawyers launched Driven Lawyers in Amsterdam on fixed fees with their own drafting tool, three more firms moved AI into management services organisations outside the partnership, and Firm Prospects counted 46 lawyers leaving Am Law 200 firms for AI companies in the first half. The strongest evidence on what this does to people came from an NBER field trial of 133 patent lawyers using Google's drafting tool for three months. When everyone then drafted without AI, the treated seniors outscored their control group by 0.45 standard deviations, while juniors showed no gain on average and split both ways, despite taking most of the time saving and reporting much higher satisfaction. Google funded the study and built the tool. On 30 September California signed SB 574: lawyers may not delegate the practice of law to generative AI and must personally verify every citation they file.

Firms and legal teams are restructuring around AI output, while the only randomised trial we have says output is the wrong measure of whether the next generation can supervise it. The juniors got faster and felt better, and their unassisted work did not improve. California has now put the supervision duty into statute, and a lawyer who has never built judgement without the tool cannot meet it. The legal engineer roles are real, and Disney and Cleary are hiring for them, but they sit on top of lawyers who can still tell a good draft from a bad one. We should protect unassisted repetitions for juniors deliberately: a share of first drafts done without AI and reviewed properly, with progression measured on judgement rather than throughput.