Judge Bruce Schroeder stared at the zoomed-in drone footage and admitted he knew “less than anyone in the room about all of this stuff.” It was November 2021, in the middle of the Kyle Rittenhouse trial. The prosecution wanted to show an enhanced video frame. The defense objected that Apple’s pinch-to-zoom algorithm might have generated new pixels, altering the image rather than enlarging it. Judge Schroeder, uncertain whether the technology changed what the jury would see, demanded expert testimony “within minutes.” The prosecution could not produce one. That was a judge encountering embedded AI, the simplest of three technologies, the legal profession has collapsed into a single word. The algorithm that enhanced the image did not create anything new. It applied a mathematical function to existing pixels. It made no decisions. It accessed no outside data. It operated the way a calculator operates: one input, one output, one bounded task. Four years later, the AI questions arriving on federal dockets involve technologies so different from that pixel algorithm that applying the same legal analysis to all three is like applying the same evidentiary standard to a calculator, a ghostwriter, and a rogue employee. The Sedona Conference published a random-sample survey of federal judges on AI this week. The National Judicial College is running a four-day AI course for judges later this year. The Federal Judicial Center published a guide. Everyone agrees judges need to understand AI. Almost nobody is telling them the first thing they need to understand: there are three of them, and the legal analysis changes depending on which one is in the room. Three Technologies, One Name Embedded AI is the calculator. It has been operating inside commercial software since roughly 2012. Spam filters, predictive text, fraud detection algorithms, the spell-check suggestions in your word processor, the search algorithm that ranks results on Westlaw. Embedded AI performs a single, bounded task on a defined data set. It does not generate new content. It does not make decisions outside its programmed function. It does not access systems beyond its own. When a law firm uses predictive coding in e-discovery to prioritize documents for review, that is embedded AI. When a bank’s fraud detection system flags a suspicious transaction, that is embedded AI. The technology is invisible, task-specific, and contained. From a legal standpoint, embedded AI operates like any other software tool an attorney might use. It stays within the system where it was deployed. It touches only the data it was designed to process. It creates no independent work product. Privilege analysis for embedded AI is straightforward: the tool operates within the attorney’s existing confidentiality perimeter the same way a legal research database does. No new privilege questions arise because no new information flows outside the controlled environment. Generative AI is the ghostwriter. It arrived in commercial force on November 30, 2022, when OpenAI released ChatGPT to the public, though the underlying technology traces to Google’s 2017 transformer architecture paper and GPT-3’s 2020 release. Generative AI produces new content from prompts: text, images, code, audio. An attorney types a question; the system generates an answer. A paralegal uploads a contract; the system produces a summary. The interaction model is one prompt in, one creation out. No autonomous action. No system traversal. The attorney initiates each interaction and reviews the output. Generative AI introduced privilege risks that embedded AI never created, because the information leaves the attorney’s control. When Bradley Heppner typed his defense strategy into Anthropic’s Claude in 2025 and 2026, he sent privileged information to a third-party commercial platform whose terms of service expressly disclaimed confidentiality. Judge Jed S. Rakoff of the Southern District of New York rejected the privilege claim in February 2026: the voluntary disclosure to a non-confidential third party destroyed whatever privilege might have existed. The technology was new. The doctrine, as Judge Rakoff noted, was not. [See “Your AI Tool Just Waived Attorney-Client Privilege,” The Technology Blind Spot, February 2026.] But generative AI is still a tool an attorney uses, not an actor that operates independently. The attorney decides what to type. The attorney chooses which platform to use. The attorney reviews the output. Every step involves a human decision point. Privilege analysis, while more complex than for embedded AI, remains traceable: you can identify the moment privileged information entered the system, the channel through which it traveled, and the terms governing confidentiality on that channel. Heppner’s waiver was visible and reconstructable because a human performed each action. Agentic AI is the rogue employee. It began entering production environments in 2024 and 2025, formalized through frameworks like CrewAI, AutoGen, and LangGraph. Agentic AI does not wait for a prompt and return a single output. It receives a goal, decomposes that goal into tasks, accesses multiple systems to execute those tasks, makes intermediate decisions about which data to retrieve and where to route it, and chains actions together without returning to a human between steps. The attorney does not initiate each action. The agent does. This is the distinction the bench must internalize before the next privilege motion involving AI: a generative AI tool is an instrument within the attorney-client relationship. An agentic AI system is an autonomous actor that makes its own decisions about where privileged information goes. Why the Distinction Changes the Privilege Analysis The attorney-client privilege requires a confidential communication between attorney and client for the purpose of seeking or providing legal advice. The critical word is “confidential.” Confidentiality requires that the communication be directed to the attorney and not disclosed to third parties outside the privileged relationship. Embedded AI introduces no third party. The tool processes data within the system where it was deployed. Privilege analysis does not change. Generative AI introduces a third party only when information leaves the attorney’s controlled environment. The analysis is Heppner: did the communication pass through a channel that maintained confidentiality? If the firm uses an enterprise AI platform with contractual confidentiality protections, the analysis looks different than when a client uses a consumer chatbot with no such protections. The question is answerable because the data flow is linear and human-initiated. Agentic AI breaks the analysis entirely. An agentic system tasked with preparing a case summary might autonomously access the document management system, the billing platform, the email archive, and an external research service. Each access involves privileged data. Each routing decision was made by the agent, not the attorney. And the intermediate steps between the agent’s starting goal and its final output may traverse systems with different confidentiality protections, different terms of service, and different data retention policies. No human directed those intermediate routing decisions. No human reviewed them in real time. And when opposing counsel moves to compel production of materials the agent inadvertently routed through a non-confidential channel, the privilege log will contain a gap that no attorney can fill, because no attorney made the decision. The Kovel doctrine, which extends privilege to third parties whose participation is reasonably necessary for competent legal advice, requires attorney supervision. Not theoretical supervision. Actual direction and control over what the third party does with privileged information. A paralegal who pulls a document does so at the attorney’s direction. An agentic system that autonomously decides which databases to query, which files to access, and how to route information between systems is not operating under attorney supervision in any sense the doctrine recognizes. [See “The Document You Didn’t Write Is Giving Your AI New Instructions,” The Technology Blind Spot, March 2026.] OWASP, the international security standards body, recognized this category distinction in December 2025 when it published the Top 10 for Agentic Applications, a framework developed by more than 100 security researchers specifically because the risks of autonomous AI agents are categorically different from the risks of generative AI chatbots. Three of the top four risks involve identity and privilege abuse: agents inheriting credentials beyond what their task requires, agents accessing systems without appropriate authorization boundaries, and agents compounding errors across multi-step workflows before any human checkpoint fires. The security community already treats these as different technologies. The legal profession has not caught up. What Legal Technology Companies Are Playing With Here is the uncomfortable reality the bench should understand: legal technology vendors are racing to add agentic capabilities to platforms that were built for generative or embedded AI. The business incentive is clear. An AI tool that drafts a memo is useful. An AI tool that drafts the memo, files it in the document management system, updates the billing entry, and sends the client an email is ten times more useful and commands a higher price point. But bolting agentic capabilities onto a platform designed for single-prompt interactions creates a specific architectural failure. Legacy legal technology systems were built with human-in-the-loop assumptions. Access controls gate human users. When an autonomous agent operates across those systems, it inherits the credentials of the user or service account that launched it. In most legacy environments, there is no granular permission model for an autonomous agent. It either has the user’s full access or it cannot function. One misdirected agent inherits every permission its launching user holds. Futurum Research found that 78% of CIOs cite security, compliance, and data control as the primary barriers to scaling agent-based AI. The concern is not hypothetical. For law firms, this means an agentic AI tool operating on a partner’s credentials has access to every client file, every billing record, and every privileged communication that partner can access. If the agent’s workflow traverses a system without adequate confidentiality protections, the privilege exposure is not limited to one document or one client. It extends to every piece of privileged information the agent touched along the way. Vendors will defend these guardrails, and the defense has merit: platforms are building human-in-the-loop checkpoints, audit trails, and role-based access controls. IBM’s watsonx, Microsoft’s Copilot Studio, the CrewAI governance framework all emphasize guardrails designed to keep agents within defined boundaries. These controls represent genuine engineering effort, and they make the agent supervisable at the endpoints of its workflow. But the privilege risk lives in the intermediate steps. An agent that requires human approval before sending the final output to a client but makes 200 autonomous decisions about which databases to query, which files to cross-reference, and which systems to traverse in between has 200 potential privilege exposure points that no checkpoint governs. The guardrails gate the destination. They do not gate the journey. A Bench-Ready Evaluation Framework When an AI-related privilege motion, sanctions question, or evidentiary challenge reaches the bench, five questions will sort the technology into the right analytical category: One: Does the system generate new content, or does it process existing data within a single application? If it only processes existing data within one system, it is embedded AI. Apply the same analysis you would apply to any software tool. Two: Does the system require a human to initiate each interaction and review each output? If yes, it is generative AI. The privilege analysis turns on whether the platform maintained confidentiality for the information the human sent to it. Examine the terms of service, the data processing agreement, and whether the platform trains on user inputs. Three: Can the system access multiple databases, applications, or external services to complete a task without human approval at each step? If yes, it is agentic AI. The privilege analysis must trace the data flow across every system the agent accessed, including intermediate systems the attorney may not have known the agent would use. Four: Who made the routing decision? For generative AI, the attorney chose to type privileged information into the system. For agentic AI, the agent chose which systems to access and how to route information between them. If the routing decision was made by the agent, the court must determine whether the agent’s autonomous choices can satisfy the supervision requirement of the Kovel doctrine or Rule 5.3’s supervisory obligations. Five: Can the privilege log be reconstructed? Generative AI interactions produce a clean audit trail: one prompt, one response, one timestamp, one platform. Agentic AI workflows may produce action logs that show what systems were accessed but not why the agent chose to access them. If the intermediate reasoning is opaque, the privilege log will contain gaps that no witness can fill. This framework is offered to the judiciary with unrestricted permission for use in judicial proceedings, opinions, orders, and published guidance. We would appreciate attribution to The Technology Blind Spot where practicable.

Originally published on LinkedIn Newsletter: The Technology Blind Spot