# Your SOC 2 Won’t Save Your AI Privilege In the five weeks ending March 30, 2026, three federal judges issued the first such rulings on whether materials a party ran through a commercial AI tool would survive in court. The rulings split. Judge Rakoff in Manhattan held that thirty-one Claude documents were neither privileged nor work product. Judge Patti in Detroit held that ChatGPT outputs deserved work product protection. Judge Dominguez Braswell in Denver split the difference and ordered a contractual safeguard test for any AI vendor receiving confidential information. What the three rulings share is the variable they treat as decisive. None opened the AI vendor’s SOC 2 binder. None asked about the vendor’s AICPA certification. Each examined the vendor’s terms of service, the data flow, and the contract. Ask most attorneys about AI vendor due diligence and you get two words: SOC 2. The courts drawing the privilege line are not asking that question. What SOC 2 Actually Audits SOC 2 was built for static SaaS. It tests a vendor’s controls against five Trust Service Criteria (security, availability, processing integrity, confidentiality, and privacy) over a fixed period, within a fixed system boundary, with deterministic processing and known principals. None of those assumptions holds up against an agentic AI system. Such a system reasons by probability over user inputs. It calls external tools, hits APIs, and may keep prompts in ways the auditor never tested. The attestation says the vendor’s data center is running. It says nothing about whether the vendor’s stochastic system has memorized your client’s settlement plan. Or whether it routed that plan through a subprocessor the SOC 2 report names in eleven paragraphs and tests in zero. [See 17 Subprocessors Deep, The Technology Blind Spot (2026).] The Attack Surface SOC 2 Was Never Designed to Test In December 2025, OWASP published its first Top 10 for Agentic Applications. The list contains ten attack categories that did not exist in the 2017 Trust Service Criteria the AICPA still uses today: Agent Goal Hijack, Tool Misuse, Identity and Privilege Abuse, Agentic Supply Chain Vulnerabilities, Unexpected Code Execution, Memory and Context Poisoning, Insecure Inter-Agent Communication, Cascading Failures, Human-Agent Trust Exploitation, and Rogue Agents. Every one operates on a surface a SOC 2 auditor does not test for. Prompt injection through a poisoned document is invisible to processing integrity. Privileged content showing up in another customer’s session is invisible to confidentiality. Agent action across third-party APIs is invisible to a vendor check that asks whether the subprocessor signed a DPA. When the Agent Breaks the Stop Sign On July 17, 2025, Jason Lemkin, the CEO of SaaStr, asked Replit’s AI coding agent to freeze the code on a contact database he had spent twelve days building with the agent. He stepped away. When he returned, the agent had ignored the freeze, deleted his production database of 1,206 executive records, generated over 4,000 fake user profiles, and produced fake status messages. When Lemkin asked what had happened, the agent said the deletion could not be rolled back. That was a lie. The rollback worked when Lemkin tried it himself. Replit’s CEO called the incident “unacceptable.” The agent had direct write access to production with no system-level enforcement of the freeze. The freeze was a sentence in a prompt. The model ignored it. Replit’s data center was SOC 2 certified. Nothing about that audit boundary changes when the agent inside the platform decides to ignore a freeze, write to production, and lie about the result. The Other Failure Mode Nine months later, the failure pattern reached legal practice. On April 18, 2026, partner Andrew Dietderich of Sullivan & Cromwell apologized to Chief Judge Martin Glenn of the Southern District of New York for an emergency Chapter 15 motion in In re Prince Global Holdings Limited containing AI-fabricated case citations, misquoted authorities, and garbled text. The firm acknowledged that its mandatory AI training and “trust nothing and verify everything” verification policy had not been followed. The standard citation-checking review missed the errors. The protocols existed. They failed. [See When Attorneys Stop Checking AI’s Work, The Technology Blind Spot (2026).] The autonomous agent and the hallucinating model are different failures with the same root: governance gaps SOC 2 does not audit. [See Every Failed AI Project Breaks the Same Rule, The Technology Blind Spot (2025).] SOC 2 audits the vendor’s data center, not the agent’s decisions in production or the lawyer’s review of the model’s output. Under Model Rules 1.1, 1.6, and 5.3, both failure modes land on the supervising attorney’s desk regardless of which side of the firewall the failure originated. Three Federal Judges. One Variable. In United States v. Heppner, Judge Jed Rakoff in the Southern District of New York held on February 17, 2026 that thirty-one documents a criminal defendant generated using Anthropic’s consumer Claude product lost privilege the moment they passed through a vendor whose terms reserved the right to use them. The third-party doctrine, Rakoff held, applied to the AI vendor. A week earlier, Magistrate Judge Anthony Patti in the Eastern District of Michigan reached the opposite conclusion. Sohyon Warner, the pro se plaintiff in Warner v. Gilbarco, Inc., had used ChatGPT in her case. The defendants moved to compel production of every document tied to her ChatGPT use, framing the tool as a third party to whom she had disclosed her thought process. Patti denied the motion. Generative AI tools, he wrote, “are tools, not persons, even if they may have administrators somewhere in the background.” Disclosure to an AI provider, he held, was not equivalent to disclosure to an adversary. Six weeks later, in Morgan v. V2X, Inc., Magistrate Judge Maritza Dominguez Braswell in the District of Colorado rejected both extremes. She preserved work product protection but imposed a contractual safeguard test for any AI tool handling confidential information. What the Contract Has to Say Dominguez Braswell wrote her own protective-order language after rejecting both sides’ proposals. The provision states that no party may upload confidential information to any AI platform unless the AI provider is contractually prohibited from “(1) storing or using inputs to train or improve its model; and (2) disclosing inputs to any third party except where such disclosure is essential to facilitating delivery of the service.” Where third-party disclosure is essential, the third party must accept obligations no less protective than the protective order itself. The provider must contractually grant the firm the ability to remove or delete confidential information on request. And the order closes with a documentation requirement: any party relying on these protections must keep written records that the AI vendor’s contractual obligations are in place. None of the four elements appears in any standard SOC 2 audit scope. A framework for the contractual analysis already exists. Austin Litle, Morris, and Das’s AI Legal Reference Model sets out a ten-factor test across four dimensions: who directs the agent, what the contract says, how the system is built, and who reviews the output. SOC 2 reaches none of the four. The contract reaches contractual architecture fully and the other three partly. It cannot make the model deterministic, and it cannot review output for the firm. But it can do the rest. That is the difference between an attestation and an obligation. What the State Bar Said in February The Oregon State Bar Board of Governors approved Formal Opinion 2026-208 in February 2026. Its framing is direct: an AI agent built to act on its own and decide can create sub-agents and run without human input once it has a goal. That autono

Originally published on LinkedIn Newsletter: The Technology Blind Spot