Catherine’s junior associate forwarded the GitHub link at 7:12 on a Wednesday morning. Subject line: “We can build this ourselves.” Catherine is a composite: a managing partner at a fourteen-attorney litigation firm in Charlotte, the type of decision-maker this blog has profiled before. The link pointed to Anthropic’s open-source repository for Claude for Legal, released eleven days earlier under an Apache 2.0 license. Twelve practice-area plugins. Twenty-plus connectors to the software her firm already runs on. Free to install. Free to fork. Free to wire into anything the firm wants. The note attached: “If we tailor this to our matter management workflow, we cut three hours of admin per attorney per day.” Her associate’s math is not wrong. Three hours of admin recovered across fourteen attorneys is forty-two hours a day of recovered capacity. At the $349 average billable rate Clio measured in 2024, that approaches $15,000 in daily revenue Catherine’s firm currently leaves on the table. Catherine is about to type “Let’s do it.” Then she remembers what she half-read three weeks earlier in a Tuesday-morning security newsletter. The headline was technical and she had skipped the body. The phrase she had not skipped: “Mother of All AI Supply Chains.” The Reframe Catherine Cannot Skip What Catherine’s associate is proposing is not adoption. It is manufacturing. Adoption is what a firm does when it buys a closed product from a vendor, signs a master services agreement, and absorbs the vendor’s representations as part of the price. Manufacturing is what a firm does when it forks open-source code, wires it into its own systems, and ships the result into production. In the manufacturing scenario, the vendor is the firm. No master services agreement exists, because no counterparty exists. No representations-and-warranties section exists, because no one made any representations. No SOC 2 report exists to read, because only the firm could produce one, and the firm has not produced one. This is the bargain Anthropic offered the legal profession on May 12, 2026[1]. The company released twenty-plus Model Context Protocol connectors and twelve plugins under an Apache 2.0 license, explicitly inviting “the solo practitioner who doesn’t have a legal-ops team” to participate. The bargain is real. The savings are real. The capacity recovery is real. What the press releases did not foreground was what had happened twenty-seven days earlier. The Twenty-Seven-Day Gap On April 15, 2026, the OX Security research team published a disclosure that may be the most important piece of writing about AI legal infrastructure released this year. The title is The Mother of All AI Supply Chains: Critical, Systemic Vulnerability at the Core of Anthropic’s MCP.[2] The findings are not subtle. The Model Context Protocol is the open standard Anthropic created and maintains for AI-to-tool communication. The protocol carries an architectural design flaw that produces arbitrary command execution on any system running a vulnerable implementation. The exposure is not a single library’s coding error. It sits inside Anthropic’s official MCP software development kits, in every supported programming language: Python, TypeScript, Java, Rust. Any developer building on the Anthropic MCP foundation inherits the exposure by default. Specific numbers OX published: over 150 million downloads of vulnerable implementations. Approximately 200,000 vulnerable server instances in the wild. Over 7,000 publicly accessible servers exposed. More than 30 responsible disclosures generated ten Critical or High severity CVEs. Six live production platforms on which OX researchers successfully executed commands. The OX team also tested how easy it would be to seed a malicious MCP server through the open-source distribution channels developers use to find code. They submitted a proof-of-concept package to eleven separate MCP marketplaces. Nine accepted it. OX recommended that Anthropic patch the protocol at the source, which would have propagated protection to every downstream library and project. Anthropic declined. The position the company took, in writing, was that the behavior is “expected” and that input sanitization is the responsibility of every individual developer who builds on the SDK. Twenty-seven days after that response, Anthropic shipped Claude for Legal and asked solo attorneys to be those developers. The Playbook Has a Name Embed first, govern later is not a new pattern. Microsoft ran the play in the 1990s. The company bundled its web browser into Windows so completely that removing it broke the operating system, and the Department of Justice spent years untangling the result. The D.C. Circuit’s 2001 ruling in United States v. Microsoft Corp. held that the bundling was monopoly maintenance.[3]The remedy arrived after the architecture was already entrenched. Google ran a variant in the 2010s. The company tied Android licensing to default placement of Google Search and Google Play, which gave its services privileged access to user behavior at the device level. The D.C. District Court’s 2024 ruling in United States v. Google LLC held that the arrangement was unlawful monopoly maintenance.[4] Twenty-four years separate the two opinions. The architecture is identical. Healthcare ran a clinical version. Nuance’s Dragon Ambient eXperience and similar embedded transcription tools wired into clinical workflows through Epic and other electronic health record systems years before HIPAA-specific guidance for ambient AI emerged. The model performed. Governance played catch-up. Financial services has its own catch-up document: the Federal Reserve’s Supervisory Letter SR 11-7, the framework for model risk management at banking organizations. SR 11-7 issued in 2011 to govern analytical models that had been deeply embedded in bank operations for years before the formal standard arrived.[5] Microsoft repeated its own playbook in May 2024 with the Recall feature, which captured continuous screenshots of user activity in Windows 11. Security researcher Alexander Hagenah’s Total Recall extraction tool, released in early June 2024, demonstrated that Recall stored screenshots in an unencrypted database accessible to any process on the machine. Microsoft delayed the launch on June 14, 2024, and restructured the feature behind virtualization-based security and Windows Hello authentication. The feature broadly shipped in April 2025. The TotalRecall Reloaded tool published in April 2026 demonstrated that the redesigned feature still leaked data through the AIXHost.exe process handoff.[6] Embed, ship, restructure on the back end. Anthropic’s twenty-seven day gap, between OX Security’s documented architectural RCE and the Claude for Legal launch, follows the same architecture. The launch is not malicious. It is also not unprecedented. It is the embed-first, govern-later playbook applied to the legal services market. The Five Hats Catherine Just Put On Catherine’s associate sees one new role: lawyer who uses AI. The actual count is higher. Programmer. Forking an Apache 2.0 plugin means assuming responsibility for it. No one maintains the plugin for Catherine’s firm. The plugin’s maintainers serve everyone, which means they serve no one in particular. When the upstream repository ships a patch, Catherine’s fork does not receive it automatically. Someone at the firm must pull the patch, test it against the firm’s modifications, and redeploy. That someone is, by default, the attorney who originally forked the code. If Catherine does not have a programmer on staff, and most fourteen-attorney litigation firms do not, the patching cadence becomes whoever-happens-to-notice. The Adobe Flash zero-day that let attackers into RSA in 2011 had been patched for weeks before the breach. The vulnerability was not the zero-day. The vulnerability was the patching gap. Catherine has just opened a patching gap. Cybersecurity reviewer. MCP connectors are not passive scripts. They are credentialed bridges to live systems. When Catherine connects her forked Claude for Legal plugin to her document management system, the plugin holds an authentication token that can read every document in the firm. Connect it to her email system, and it can read every privileged communication. The OX research demonstrated that prompt injection through a poisoned document, an email attachment, or a poisoned MCP marketplace listing can hijack that token. The cybersecurity review needed to catch a tool-poisoning attack before deployment is the kind of review a fourteen-attorney litigation firm does not staff for. Risk manager. Every connector Catherine adds extends the firm’s attack surface. The decision about which connectors to install, which to disable, and how to monitor them for anomalous behavior is risk-management work. It is not legal work. It is not billable. It is not training Catherine received in law school or in twenty-two years of practice. Governance owner. ABA Formal Opinion 512, issued on July 29, 2024, addresses the duties lawyers owe when they use generative AI tools.[7] One of the duties Opinion 512 emphasizes is the supervisory obligation under Model Rule 5.3[8], which extends to outside vendors providing AI services. The opinion expects lawyers to perform due diligence on a vendor’s security protocols, hiring practices, and conflict-checking systems. When Catherine is the vendor, because she forked the plugin, the supervisory duty does not vanish. It recurs back on her. She must perform due diligence on her own security protocols, her own hiring practices, and her own conflict-checking systems. The duty has the same shape it had when she was buying from Westlaw. The difference is that Westlaw has a compliance team. Catherine has a fourteen-attorney litigation firm. IT operator. The MCP servers running Catherine’s forked plugins live somewhere. Sometimes that somewhere is a server in the firm’s office, sometimes a cloud account the firm maintains. Either way, someone patches the operating system, monitors the logs, rotates the credentials, and notices when something looks wrong. [See Your AI Agent Was Built by an AI. SOC 2 Audited Neither., The Technology Blind Spot (2026).] That prior piece examined the limits of vendor-side audits for AI-generated code. This piece examines what happens when the audit boundary moves inside the firm. One Disclosure Before the Steelman The author ships software that runs on Claude. The critique above and below targets two architectural choices: the MCP design decision OX disclosed and the go-to-market timing of the Claude for Legal launch. Both are choices. Both reward scrutiny. Critiquing an architectural decision is not critiquing the company that made it. The distinction matters because the alternative architectures (closed protocols, slower launches, gated marketplaces) carry their own costs, and Catherine should know which costs she is choosing. Why the Steelman Almost Works Open ecosystems have a real case, and Catherine should hear it before she decides. Open-source software democratizes access. A solo practitioner can build the workflow that used to require a six-figure legal-operations team. Apache 2.0 licensing offers transparency that closed vendors cannot match. The reader can examine every line of every plugin before installing it. Forking eliminates vendor lock-in. Open distribution invites scrutiny that closed ecosystems suppress: thousands of researchers find flaws that a single vendor’s security team would miss. The OX disclosure itself is evidence that the model works. Open scrutiny found the architectural flaw. Closed scrutiny might have missed it for years. Each of those points was correct for traditional open-source code. Forking a Linux utility, an Apache web server, or a JavaScript library gives Catherine software. She runs it. If she does not like it, she uninstalls it. The software does not, on its own, reach out to her client data with credentials that authorize it to read, write, or execute. MCP forks are not that. A forked MCP connector is a credentialed bridge to live systems. The connector holds a token. The connector takes actions. The connector reads private data, processes untrusted external content, and communicates back to other systems. Security researcher Simon Willison calls this configuration the “lethal trifecta” for AI agents: private data, untrusted content, and external communication.[9] Any agent with all three becomes a full-system compromise vector through prompt injection alone. The “you can read every line” defense assumes Catherine can recognize a tool-poisoning payload by reading the plugin source. The OX researchers needed months of dedicated focus to identify the architectural class of vulnerability in code that was already public. The reading defense is a defense in the limit case. It does not scale to the working lawyer at 6:40 in the morning. Where the Argument Breaks This argument applies specifically to firms tempted to customize. A firm that uses Claude for Legal exactly as Anthropic ships it, through the official Cowork or Claude interface, with only the verified MCP connectors in Anthropic’s official registry, sits in a different position. The plugin is then a closed product. Anthropic carries the maintenance obligation. The MSA exists. The representations exist. The audit boundary, such as it is, is not Catherine’s. What this argument does not say is “do not adopt legal AI.” It says “do not manufacture legal AI.” The first is a question of competence under Model Rule 1.1[10]. The second is a question of whether the firm is, in fact, also a software vendor. The Safety Net Just Got Smaller Catherine might assume that if the embed-first playbook crosses a line, regulators will say so. History says they will, eventually. The intervening period is where the costs land. On December 22, 2025, the Federal Trade Commission reopened and set aside its 2024 consent order against Rytr, the AI writing assistant earlier accused of enabling fake reviews. The agency found that the original complaint “failed to satisfy the legal requirements of the FTC Act” and that the order “unduly burdens artificial intelligence innovation” in conflict with the Trump Administration’s AI Action Plan.[11] The action tracked a December 2025 executive order. That order directed the FTC to issue, by March 11, 2026, a policy statement clarifying how Section 5 of the FTC Act reaches AI and when state laws on AI outputs are preempted. The FTC has not retreated from AI enforcement. Operation AI Comply remains live; cases including DoNotPay and the Growth Cave and Air AI actions proceeded after Rytr was vacated.[12] The narrowing is jurisdictional, not abdicational. The agency’s authority reaches consumer deception, not architectural integrity. The FTC will not, on Catherine’s behalf, vet the security post

Originally published on LinkedIn Newsletter: The Technology Blind Spot