THE TECHNOLOGY BLIND SPOT

Five years ago, a trainee in Clifford Chance’s investment funds seat spent his days mapping retail fund prospectuses against the content requirements of Appendix C of Hong Kong’s Unit Trusts Code. The work repeated until the repetition became the point. Jamie Tso started wondering whether a small tool could do part of the mapping for him, so he taught himself enough machine learning to be dangerous, hired engineers on Upwork, and spent nights wrestling TensorFlow and BERT toward something useful. It never arrived. The tooling was immature, the problem was hard, and the prototype died the way most prototypes die: quietly, without a funeral.

Then the tooling changed. Clifford Chance switched on no-code automation through its Microsoft subscription, Copilot Studio and Power Automate, and handed associates what Tso describes as a playground. He got obsessed. He built document-processing tools for colleagues, then fielded automation requests from partners in other offices, and some of his tools went viral inside the firm and won formal adoption. He taught himself to write real code on weekends, pushed past the no-code ceiling, and open-sourced the results. By January 2026, his repositories had drawn more than a hundred forks, an Artificial Lawyer interview had made him the most discussed associate in legal technology, and lawyers on three continents had a new hobby.

His movement now has a name borrowed from the AI world, vibe coding, and momentum that keeps compounding. Within three weeks of the interview, a platform called Vibecode.law launched to host lawyer-built tools. By April, Bloomberg Law argued that firms banning the practice would “lose twice.” In 2026, 83 percent of lawyers report broad AI access, up from 61 percent a year earlier. An attorney can describe software in plain English before breakfast and run it by lunch.

Software engineers have watched all of this with the particular expression of people who know how the sequel ends. Their trade coined a name decades ago for building what you could buy: rolling your own. Attorneys borrowed the practice without the phrase. The phrase carries the warning.

The Phrase Was Never a Compliment

“Roll your own” earns its reputation from a prohibition every programmer absorbs early: don’t roll your own crypto. Bruce Schneier explained why in a sentence that now carries his name as Schneier’s Law: “Anyone can design a cipher that he himself cannot break.” The builder’s confidence is not evidence of the build’s quality. It is evidence of the builder’s limits.

Security, though, is the smaller half of the warning, and the vibe-coding security record has its own entry in this blog. [See Your AI Agent Was Built by an AI. SOC 2 Audited Neither, The Technology Blind Spot (2026).] The larger half is an accounting problem the software industry has measured for fifty years and the legal profession has not yet met.

The build is the cheap part. Across five decades of software engineering research, writing the code accounts for a minority of what a program costs over its operating life, and maintaining it consumes the rest. The attorney who vibe-codes a tool in an afternoon has purchased the smallest slice of that tool’s lifetime cost and signed for the remainder without reading the terms.

Fifty Years of Receipts

Robert Glass compiled the consensus in Facts and Fallacies of Software Engineering: maintenance typically consumes 40 to 80 percent of software costs, with 60 percent as the working average. The federal government supplies the number at scale. GAO reported in July 2025 that $83 billion of planned fiscal year 2025 IT spending, 79 percent of the total across the 24 largest agencies, goes to operating and maintaining existing systems. Not building. Keeping.

Maintenance dominates because code does not sit still. Everything around it moves. Operating systems update. The model provider deprecates the endpoint your tool calls. A researcher publishes a vulnerability in a library your AI selected for you, from a version list frozen the day you typed the prompt. The document management system changes its export format, and the parser that worked for eleven months returns garbage on a Tuesday. Each event generates work, and the work lands on whoever owns the code.

Nobody has ever demonstrated what happens when ownership lapses more expensively than a trading firm in Jersey City.

Forty-Five Minutes in August

At 8:01 on the morning of August 1, 2012, Knight Capital’s internal systems began generating automated emails flagging an error in the firm’s order router. Ninety-seven of them went out before the market opened, each referencing the same disabled function: Power Peg. Nobody acted on them. Knight had not designed them as alerts, and the personnel who received them generally did not read them.

Knight was, at that moment, one of the largest market makers in American equities, handling roughly one of every ten shares traded. In the final days of July, its engineers had deployed new code in stages to the firm’s order router, supporting a New York Stock Exchange program set to launch August 1. The router ran on eight servers. A technician copied the new code to seven of them. No second technician checked the deployment, because no written procedure required one.

The eighth server still carried Power Peg, a manual market-making function Knight had retired in 2003. The firm had deprecated the feature, migrated its users, and moved on. It never removed the code. In 2005, a refactoring relocated the safety counter that told Power Peg when to stop. For nine years the function sat in production, dormant, disconnected from its own brakes. The new deployment reused Power Peg’s old activation flag for a new purpose, and on the one server that never received the new code, the old meaning still applied.

At 9:30 the market opened. Seven servers processed orders correctly. The eighth resurrected a nine-year-old ghost. While handling 212 small retail orders, Knight’s router fired more than four million executions across 154 stocks, over 397 million shares, accumulating roughly $3.5 billion in unwanted long positions and $3.15 billion in unwanted short positions. Knight’s technicians, hunting the fault in a live market, uninstalled the new code from the seven healthy servers, which activated Power Peg on all of them. Forty-five minutes passed before the firm stopped it. The loss exceeded $460 million by the SEC’s accounting, against roughly $365 million in available capital. Knight survived the week only through emergency financing, sold itself to a rival within months, and paid the SEC a $12 million penalty for failed market access controls. The largest trader in U.S. equities was effectively finished by lunchtime, undone by code it had decided to throw away nine years earlier.

Read that sequence again with the vibe-coding debate in mind. Knight employed professional engineers. It ran a real deployment process, reviewed its code, and operated under federal risk-control regulation. One lapse in ownership, one server nobody double-checked, one deprecated function nobody deleted, one inbox nobody owned, ended the company in less time than a partner spends in a status meeting. Disposal, it turns out, is also maintenance. Knight made the decision to dispose of Power Peg in 2003. Nobody finished the job, and the unfinished 10 percent cost $460 million.

The Fork Is on You

Tso’s interview contains this entire argument in a single sentence, offered without apparent alarm. Asked whether law firms can take his open-source tools from GitHub and whether he will maintain them, he drew the line precisely: firms can run the tools as-is, a scaled deployment needs additional engineering around hosting, user management, security, and support, and once someone forks a repository, “maintenance of that fork is on them.” More than a hundred forks exist. Each one is a quiet transfer of ownership, from a builder who understands every line to an organization that, in most cases, cannot read any of them.

Consider where those forks land. Catherine, the composite managing partner who anchors this blog, runs a 14-attorney firm in Charlotte and bills $475 an hour. Suppose her sharpest associate forks a contract-comparison tool, wires it into the firm’s document system, and it works. It works so well that within a quarter the intake team depends on it. Nobody voted to make it infrastructure. Infrastructure is simply what working software becomes. When the model provider changes its API and the tool starts silently truncating documents, the associate becomes the help desk, the release engineer, and the security team, at the hourly rate of the legal work now sitting untouched. The firm never bought software. It hired an unpaid vendor with a full caseload and no backup.

Then the vendor leaves. Engineers measure this exposure with a grim metric called the bus factor: the number of people who can maintain a system before it becomes unmaintainable. For attorney-built tools, the bus factor is one, and the one is mobile. Tso is a senior associate, which puts him a few years from partnership, a lateral move, or a startup of his own. His firm, at least, has an innovation function and a Microsoft enterprise stack behind him. The associate at Catherine’s firm has a laptop. When the one person who can read the code walks out with the code still running, the firm holds exactly what Knight held: production software with no owner, waiting for the flag to flip.

The Case for Building, at Full Strength

Tso himself makes the best argument for building, and it deserves an honest hearing. He argues the economics are shifting: as coding agents improve, the cost of building high-quality internal tools is collapsing, which points toward just-in-time, disposable software, built for one workflow and discarded when the workflow changes. In that world, he contends, long-term maintenance matters less, and most internal tools never need to scale beyond the team that uses them. Bloomberg Law adds the procurement case: what lawyers build, and what they never bother building, is the most direct product research the industry has ever produced, and a firm that prototypes internally negotiates with vendors from knowledge instead of hope.

Both arguments are genuinely strong, and the second is simply correct. Building to learn what to buy is the best use of vibe coding on offer. The flaw sits inside the first argument, and Knight Capital marks the spot. Disposable software is only disposable if someone performs the disposal, and disposal is itself a maintenance act, the exact act Knight began in 2003 and never completed. Law firm tools that touch client data do not get discarded when the workflow changes. They get promoted. A tool that works gets used, a tool that gets used becomes infrastructure, and no partner schedules a meeting to decommission software that works. The just-in-time world Tso describes may arrive. The firms adopting his tools live in this one, where the fork is on them and nobody has told the managing partner.

Two Disclosures

I co-founded a legal technology company, so an essay warning attorneys about building instead of buying reads like a vendor defending his lane. Fair. Weigh the argument against the SEC’s forensic accounting and Glass’s five decades of data, not against my payroll. The Knight analogy also breaks in one place worth naming: Professional engineers wrote Knight’s code, and it still failed, which cuts in both directions. It proves that human-written, expert-reviewed code kills when ownership lapses, and it leaves open the hope that AI agents will someday shoulder maintenance cheaply. Costs per fix will likely fall. Responsibility will not transfer. When the tool fails at 4 PM ahead of a filing deadline, the model that wrote it will not answer the phone. Someone at the firm will.

Thursday

One email goes out Thursday morning, to every attorney and staff member: list every tool you built, forked, or configured yourself that touches firm or client data. For each answer that comes back, three questions on a single page: who maintains it, where the data goes, and what happens when the builder leaves. Any tool missing an answer moves off client data by Friday and back into the sandbox, where prototypes belong and where they can keep doing their legitimate job: teaching the firm what to buy.

Jamie Tso built something real, and the profession is right to study him. Study the whole interview, though, including the sentence about the fork. Knight Capital’s systems sent 97 warnings before the opening bell on the worst morning in the firm’s history, and the warnings went unread because nobody was responsible for reading them. Every firm running lawyer-built software is now accumulating an inbox of its own. The warnings will arrive. The only open question is the one the Thursday email answers: who reads them.

About the Author

JD Morris is Co-Founder and COO of LexAxiom, an Agentic AI platform for the business of law. Over a 25-year career, he has built and scaled enterprise technology products across Dell, EMC, VMware, and Cisco, including the first exabyte eDiscovery platform. He holds dual MBAs from Columbia Business School (Finance) and UC Berkeley Haas (Marketing), a Master of Legal Studies in Cybersecurity Law from Texas A&M, and a Master of Engineering from George Washington University. He writes The Technology Blind Spot on the intersection of emerging technology and law. Connect with him on LinkedIn at www.linkedin.com/in/jdavidmorris, on X at @JDMorris_LTech, or on Bluesky at @JDMorris-ltech.bsky.social.

References

1. Jamie Tso Interview: Vibe-Coding Your Own Legal AI Tools, Artificial Lawyer (Jan. 5, 2026), https://www.artificiallawyer.com/2026/01/05/jamie-tso-interview-vibe-coding-your-own-legal-ai-tools/.

2. Knight Capital Americas LLC, Exchange Act Release No. 70694, Admin. Proc. File No. 3-15570 (Oct. 16, 2013), https://www.sec.gov/files/litigation/admin/2013/34-70694.pdf.

3. Andrew Thompson, Vibe Coding Empowers Lawyers to Influence AI Winners, Losers, Bloomberg L. (Apr. 20, 2026), https://news.bloomberglaw.com/legal-exchange-insights-and-commentary/vibe-coding-empowers-lawyers-to-influence-ai-winners-losers.

4. Vibecode-Law Launches: An Open Platform for DIY AI Tools, Artificial Lawyer (Jan. 26, 2026), https://www.artificiallawyer.com/2026/01/26/vibecode-law-launches-an-open-platform-for-diy-ai-tools/.

5. Bruce Schneier, Amateurs Produce Amateur Cryptography, Schneier on Sec. (May 12, 2015), https://www.schneier.com/blog/archives/2015/05/amateurs_produc.html.

6. Robert L. Glass, Facts and Fallacies of Software Engineering 115 (2003).

7. U.S. Gov’t Accountability Off., GAO-25-107795, Information Technology: Agencies Need to Plan for Modernizing Critical Decades-Old Legacy Systems(July 17, 2025), https://www.gao.gov/products/gao-25-107795.