Plug and Pray?

The Software Disappeared and Nobody Noticed

For about thirty years, enterprise software had a deal with its users: you would learn its interface, adapt to its workflows, click through its menus, and in exchange it would do the thing you bought it for. This was, objectively, not a great deal for the user, but everyone got used to it.

That era is ending. In April 2026, Salesforce launched something called Headless 360, which exposes its entire platform, over 60 MCP tools and 30 preconfigured coding skills, as infrastructure for AI agents.[1] No browser required. There is no interface anymore. The agent is the interface. You tell it what you want; it goes and does things to various pieces of software on your behalf; you get a result. The software is still there, technically, but you never see it or touch it. It has become headless.[9]

"Headless," in the technical sense, means software running without a user-facing front end. It is, when you think about it, a slightly ominous word to use for a thing you are trusting with your most sensitive data.

For most industries, this is a story about efficiency. For legal, it is a story about how you can accidentally waive your client's privilege by asking a question.

Here is the problem. Attorney-client privilege, the thing that lets lawyers and clients talk candidly without worrying that the conversation will be used against them, was designed for a world where lawyers controlled which systems touched client data. You knew who you were talking to. You chose the room. In the headless world, an AI agent autonomously routes your client's queries, documents, and confidential communications across multiple third-party services through Model Context Protocol connections, often without you knowing which services received the data, whether they kept it, or whether any contractual obligation to maintain confidentiality exists at any of the hops along the way.

So the lawyer asks a question and gets a helpful answer, and between those two events, five different companies briefly possessed the client's most privileged communications. This is the feature, not the bug. The abstraction that makes agents useful is the same abstraction that makes privilege preservation nearly impossible without deliberate architectural intervention.

This article maps the privilege risks, identifies four paradigm shifts generating novel questions, and proposes solutions. The core thesis is the same one I advanced in "The Claw Is the Law?" regarding the OpenClaw ecosystem: AI will not replace lawyers. It will create more law. The headless revolution does not diminish the need for privilege doctrine — it dramatically expands it. The lawyers who understand how data flows through agent architectures will be the ones who preserve their clients' most fundamental protection. Everyone else will find out about the problem during a waiver motion.

The Architecture

So: what is actually happening when you use one of these things?

Prior waves of legal technology, cloud practice management, then generative AI tools, each involved a discrete, identifiable disclosure. One vendor, one contract, one set of data handling policies to evaluate. You could look at it, think about it, and decide "yes, I am comfortable sharing client data with this company under these terms." That is a thing a lawyer can do.

The headless paradigm is different because it introduces autonomous, multi-hop data flows. The AI agent decides which services receive the data, and it may chain multiple services together in a single workflow. Each one is a separate potential disclosure that the lawyer never individually authorized.[2]

I am going to keep coming back to this phrase, "the lawyer never individually authorized", because it is doing a lot of the work here. Privilege law, historically, assumes the lawyer is making affirmative decisions about disclosure. What happens when the lawyer is not deciding anything, because the software is deciding for them? That is, more or less, the whole article.

The connector that makes this possible is MCP, the Model Context Protocol developed by Anthropic and now adopted as an industry standard. Think of it as USB-C for AI: one open standard that connects a single agent to every app, database, and service in an enterprise environment.[3] It crossed 97 million installs in April 2026, up from under 5 million six months prior.[4]

And it is already in law firms. Definely launched MCP tools for legal review on April 30, 2026, and Troutman Pepper Locke is running it alongside its proprietary AI agent Athena.[5] [11] General Legal, a Y Combinator-backed law firm, has launched what appears to be the first production MCP server designed for AI agents to upload contracts for professional review, track status, and download attorney-redlined documents.[10] Legora has launched MCP connectors for its case law and statute databases.[12]

So here is a concrete scenario. A corporate counsel asks an AI agent: "Review the email chain between our CEO and the vendor, compare it to the contract terms, and assess our exposure for breach of the implied covenant of good faith."

In a traditional workflow, the counsel logs into each tool, copies relevant excerpts, conducts the analysis in a privileged environment. The counsel controls every step.

In the headless workflow, the agent might:

1. Pull the email chain from the company's Microsoft 365 instance via MCP

2. Retrieve the contract from a document management system via MCP

3. Query a legal research service for relevant case law via MCP

4. Route the assembled package to an LLM for analysis via API

5. Cross-reference the result against a risk assessment tool via MCP

Figure: Five-Hop Data Flow Diagram

Five hops. Five different third-party services. Five separate privilege analyses. The counsel who issued that single instruction may not know which of these steps occurred. The agent does not present a routing manifest before executing. It does not ask, "I'm about to send the CEO's emails to a legal research service operated by a company incorporated in Ireland, shall I proceed?" It just does it.

The lawyer experiences a seamless, instant answer. The privilege doctrine experiences five separate third-party disclosures, each with its own confidentiality analysis, each governed by a different set of terms of service, and at least one of which may be hosted in a jurisdiction with different data protection obligations than the lawyer assumed.

And the speed of adoption makes this an operational reality, not a law review hypothetical. Gartner predicts 40% of enterprise applications will feature task-specific AI agents by end of 2026.[6] Deloitte expects 75% of companies to invest in agentic AI this year, projecting the market at $8.5 billion in 2026 and potentially $35 billion by 2030.[7] But Gartner also predicts that over 40% of agentic AI projects will be canceled by end of 2027 due to "escalating costs, unclear business value, or inadequate risk controls."[8]

Forty percent canceled for inadequate risk controls. In regulated industries, the consequences of inadequate risk controls in privilege-sensitive workflows are not measured in wasted license fees. They are measured in waived privileges, malpractice exposure, and client relationships that end badly.

Three Courts, No Consensus

On February 17, 2026, Judge Jed Rakoff of the Southern District of New York issued what appears to be the first federal ruling on AI and attorney-client privilege, in United States v. Heppner.[13] Six AmLaw firms published client alerts within sixty days.[14] That is a lot of client alerts.

The facts were simple. A criminal defendant used Claude, Anthropic's publicly available AI assistant, to prepare documents outlining potential defenses. He later shared those documents with his attorney and claimed they were privileged.

Judge Rakoff disagreed. His reasoning was blunt: Heppner "does not, and indeed could not, maintain that Claude is an attorney."[15] Right. Fine. But the opinion went further, examining whether the AI platform could qualify as a "necessary agent" under privilege doctrine, and finding that it could not, because there was no reasonable expectation of confidentiality. The court pointed to Anthropic's privacy policy, which states that it collects user "inputs" and "outputs" and uses that data to "train" Claude.[16]

So: you told a thing your secrets, and the thing's terms of service said it could use your secrets to train itself. Under those conditions, no, you did not have a reasonable expectation of confidentiality. This is not exactly shocking.

But. One week earlier, a different federal court reached a different conclusion. In Warner v. Gilbarco, Inc. (E.D. Mich., Feb. 10, 2026), the court found that AI-assisted drafting materials were protected by the work product doctrine because "the doctrine shields a party's litigation-related thought processes regardless of the medium through which they are expressed."[17] And in Morgan v. V2X Inc. (D. Colo., Mar. 30, 2026), a court treated generative AI programs as "tools" rather than third parties that receive confidential disclosures.[18]

Figure: Federal Court Split — Heppner vs. Gilbarco vs. Morgan

So we have what can be called a "split" in the federal courts:[19] Heppner establishing a "disqualifying" approach (AI use can vitiate privilege) and Gilbarco/Morgan establishing an "instrumental" approach (AI tools are no different from spell-checkers). As Mintz put it: "three courts, no consensus."[20]

Now. The Gilbarco reasoning works when the AI tool is a discrete application the lawyer chose to use, a word processor with a grammar-check function. One tool, one input, one output. The analogy to a spell-checker holds because the interaction is self-contained.

But in a headless architecture, the agent is not one tool. It is a meta-tool that summons other tools. The lawyer did not choose each of the five MCP endpoints the agent accessed. The lawyer may not even know those endpoints exist. A spell-checker does not, in the middle of checking your grammar, forward your brief to a separate company's server for additional analysis. An AI agent in a headless architecture does exactly that.[3]

This is, I think, the crux of the problem. The "instrument" analogy collapses the moment the instrument starts making independent decisions about which other instruments to involve. My calculator does not, mid-calculation, decide to phone a friend. Or if it did, I would want to know about it.

Under Heppner, every MCP connection to a third-party service that retains data without a confidentiality obligation is a potential privilege waiver, and the agent may establish dozens per query. Under Gilbarco, the tools are mere instruments and privilege flows through unimpeded. But Gilbarco was decided in a world of single-tool interactions. Whether it survives contact with multi-hop, autonomous agent architectures is an open question.

For lawyers advising firms on AI adoption, the prudent course is obvious: assume Heppner controls until the circuit courts resolve the split. Build the architecture to preserve privilege under the most demanding standard. If Gilbarco ultimately prevails, you will have overbuilt your privilege infrastructure, an outcome no client will complain about. If Heppner prevails and you designed for Gilbarco, the consequences are irreversible.

Disclosure Without Consent

Here is a thing that is strange about all of this, if you sit with it for a second.

Traditional privilege analysis assumes that the lawyer controls the disclosure. The lawyer decides which documents to share, with whom, and under what protections. Waiver is an affirmative act: the lawyer transmits privileged information to a third party without a confidentiality agreement, and the privilege is lost.

But when an AI agent routes a privileged query through five MCP-connected services, the lawyer did not affirmatively choose to disclose to each of them. The agent made that routing decision autonomously. The lawyer issued a direction, not a disclosure. But the result, privileged information reaching third parties, is the same.

This is the problem of disclosure without consent. And it is genuinely novel. The entire edifice of waiver doctrine assumes someone made a choice.

The ABA has provided some guidance, though not in this specific context. ABA Formal Opinion 512 (2024) established that lawyers using generative AI must comply with Model Rule 1.6's duty of confidentiality, "reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to" client information.[21] The Opinion instructs lawyers to evaluate, before inputting client information into any AI tool: the likelihood of disclosure, the sensitivity of the information, the difficulty of implementing safeguards, and the extent to which safeguards would negatively impact representation.[22]

But Opinion 512 was written for a paradigm where a lawyer consciously inputs information into a specific tool. It does not address a paradigm where an agent autonomously distributes information across a network of tools the lawyer may not have individually evaluated. The evaluation Opinion 512 contemplates as ex ante has become, functionally, ex post. And an ex post privilege analysis is another term for a privilege review during a waiver motion, which is to say, too late.

There is a structural irony here: the more seamless and efficient the agent, the less opportunity the lawyer has to exercise the judgment the ethics rules assume. The technology works by removing the decision points that privilege law assumes exist.

Model Rule 5.3 requires lawyers to ensure that third-party service providers comply with the lawyer's professional obligations.[23] In a headless architecture, every MCP endpoint is functionally a third-party service provider. But the Rule envisions a lawyer selecting a vendor, negotiating terms, and monitoring compliance. It does not envision a lawyer whose agent selected a vendor autonomously, at runtime, with no negotiation step. If a court applies Rule 5.3 strictly, the lawyer's obligation extends to every MCP endpoint the agent might access, every possible routing path. For a platform with dozens of available connections, that evaluation may be practically impossible.

And the pace of change makes it worse. New MCP servers launch weekly. Agent capabilities expand with every model update. What was evaluated last quarter may already be stale. The pace has outstripped any reasonable interpretation of "ongoing monitoring."

A 2026 Gravitee survey found that only 24.4% of organizations have full visibility into which AI agents are communicating with each other.[24] If an organization does not even know which agents are talking to each other, it certainly cannot certify that every data flow preserves privilege.

Open vs. Walled Gardens (and Open-Source)

The headless revolution is producing two, no, three, architectural strategies, and your privilege exposure depends heavily on which model you are sitting inside.

The Open Model: Salesforce Headless 360, makes every platform capability available as an MCP endpoint. Maximum interoperability. Any agent, from any vendor, can access any capability. From a privilege standpoint, this is the most dangerous: the more endpoints, the more potential disclosures, and the harder it is to maintain anything coherent.

The Walled Garden Model: SAP recently blocked external AI agents across its platforms entirely.[25] The platform vendor mediates every interaction, maintains data boundaries, enforces confidentiality at the infrastructure level. Safer for privilege. Worse for flexibility.

Figure: Platform Architecture Models — Open vs. Walled Garden vs. Open-Source

And then there is the open-source model. In May 2026, former Latham & Watkins associate William Chen launched Mike, an open-source legal AI platform claiming parity with Harvey and Legora, for free.[36] Within 72 hours: over 1,000 GitHub stars, the most for any legal tech project in history.[37]

The privilege implications of open-source cut both ways. If you run it entirely on-premises, the data never leaves your infrastructure, there is no third party to disclose to, and the privilege analysis simplifies dramatically. If it connects to external LLM APIs, as Mike does, routing through Claude or Gemini, you reintroduce the same third-party questions as any proprietary platform, with the added complication that you, not a vendor, configured those connections. There is no vendor to blame, no enterprise agreement to fall back on, no customer success team to call. You own the architecture entirely. Which means you own the privilege consequences entirely.

This is not merely a technology architecture question. It is a privilege architecture question. When Thomson Reuters decides whether Westlaw becomes an open MCP endpoint or a walled garden, it is deciding whether AI agents from every vendor on earth can query its case law database with client-specific research requests, requests that, by their very nature, reveal litigation strategy and privileged thinking.

Legal technology investors are tracking this. One analysis characterized the shift as a potential "SaaSpocalypse" for standalone legal SaaS, a compression of contract review, document analysis, and billing management tools as their core workflows get absorbed into broader agent platforms.[26] Whether or not that prediction proves accurate, the privilege implication is real regardless of the market outcome: if discrete tools that once provided natural data boundaries consolidate into a single agent interface, the firm needs a new mechanism to enforce those boundaries.

Shadow Agents: What You Can't See Can Waive Your Privilege

Perhaps the most insidious privilege risk is the one nobody can see.

"Shadow AI" refers to AI agents operating inside an organization without the security or legal team's knowledge. As CIO reported in April 2026, shadow AI has "morphed into shadow operations," with agents connecting to external APIs and MCP servers that have never been reviewed, scoped, or inventoried.[27]

In the privilege context, shadow agents are catastrophic. A junior associate who connects a personal AI agent to the firm's document management system via an unsanctioned MCP connection has potentially exposed every document in that system to whatever confidentiality guarantees the agent's backend provides, which may be none.

The IBM X-Force 2026 Threat Intelligence Index reported a 44% surge in exploitation of public-facing applications.[28] Separately, security researchers documented over 12,000 API keys and passwords exposed through insecure MCP credential handling across enterprise environments.[28a] If credentials for privileged systems are compromised through insecure MCP configurations, the resulting unauthorized access may constitute a privilege waiver, confidential communications exposed to unauthorized third parties.

The Center for Internet Security published an MCP Security Guide in April 2026 recommending continuous discovery of every agent and MCP server connection, runtime enforcement at the tool invocation layer, and audit trails attributing every agent action to a specific identity.[29]

Last month a managing partner told me her firm had "locked down AI", approved two tools, blocked ChatGPT on the network, published a three-page policy. Then I asked whether anyone had inventoried the browser extensions her associates had installed, or whether any of them had connected a personal Claude or Copilot instance to their OneDrive. The question landed badly. Nobody had looked.[5]

Most firms have not. This is the managed-AI equivalent of "we have a clean desk policy" in a firm where everyone works from home. The policy exists. The desks do not.

You cannot govern what you have not found. The CIS Guide's recommendations, continuous discovery, runtime enforcement, identity-attributed audit trails, are not IT hygiene. They are the minimum standard for complying with Model Rules 1.6, 5.1, and 5.3 in an environment where any associate with a browser can create an unsanctioned data pipeline to an unvetted third party. Agent discovery is not an IT project. It is a professional responsibility obligation.

Solutions (Or: What to Actually Do About This)

The risks above are being created in real time. Addressing them requires technical, contractual, and regulatory action at the same time. Here is what the privilege-preserving architecture looks like.

Technical

Zero Data Retention. The strongest posture is zero data retention: MCP endpoints that do not log, cache, index, or train on inputs. If a service retains nothing, there is nothing to subpoena, nothing to produce in discovery, and nothing for opposing counsel to argue constitutes a waiver.

But, and this is important, zero data retention is the gold standard, not the minimum threshold. A service that retains data but operates under a binding confidentiality agreement can still satisfy Heppner's core requirement. The Heppner court did not hold that data retention per se waives privilege. It held that disclosing information to a third party with no obligation to maintain confidentiality waives privilege. Anthropic's public terms, which permitted collection and use of inputs for training, were what defeated the claim, not the mere fact that data was processed on Anthropic's servers.

Figure: Privilege Risk Spectrum — Zero Retention to No Confidentiality

So the analysis is layered. Zero retention eliminates the argument entirely, "there is literally nothing to fight about because no data exists." Retention with contractual confidentiality means a defensible position but one you may need to actually defend. The difference is between dispositive and litigable. Both can work. One is considerably less stressful.

In practice, you have to look at every layer. A legal research MCP tool might promise "no data retention," but if it runs on a cloud provider that logs API requests for debugging, those logs may contain the substance of a privileged query. Definely's approach, deterministic tools called by agents, with the philosophy of "don't ask AI to check itself"[30], points in the right direction.

Agent Audit Trails. Every agent action, every MCP connection, every routing decision must be logged in immutable, auditable records the firm can retrieve on demand. Consider what happens when a client's privilege is challenged two years later. The lawyer needs to prove exactly which services received the query, what data each saw, whether any retained it, and whether each was operating under a confidentiality agreement at the time. Without an audit trail, that proof does not exist, and the privilege claim collapses.

This is the privilege equivalent of what can be termed as "observability" for the OpenClaw ecosystem [31], the monitoring layer for agent-mediated workflows. Just as Datadog became indispensable when microservices replaced monoliths (because you cannot debug what you cannot trace), agent-mediated legal workflows require step-by-step execution traces, tool call lineage, and anomaly alerts.

Privilege-Aware Routing. A two-tier architecture that separates privileged from non-privileged workflows. Privileged communications restricted to a pre-approved whitelist of MCP endpoints satisfying the Heppner test. Non-privileged data, general research queries that do not reveal client identity or strategy, can flow more freely. This is functionally an ethical wall at the agent level, analogous to the conflicts walls firms already maintain.

Contractual

MCP Endpoint Confidentiality Agreements. Every MCP-connected service that may receive privileged data should be subject to a standalone confidentiality agreement, not standard SaaS terms of service, but an agreement specifically addressing: data retention (prohibited), training use (prohibited), third-party access (restricted), response to legal process (notification obligations), and breach notification (immediate). Modeled on outside counsel engagement letter confidentiality provisions.

Agent Vendor Due Diligence. Privilege-specific due diligence covering: which MCP endpoints the agent can access, how routing decisions are made, whether it can establish new connections dynamically (it should not, for privileged workflows), audit capabilities, and whether the vendor will cooperate in privilege litigation.

Client Consent Frameworks. Model Rule 1.6(a) provides that a lawyer "shall not reveal information relating to the representation of a client unless the client gives informed consent."[38] The corollary: informed consent can authorize disclosure that would otherwise breach confidentiality.[41] Update engagement letters to disclose agent-mediated workflows, which categories of services may receive client data, the protections in place, and options for opting out on sensitive matters.

Regulatory

ABA Formal Opinion on Agentic AI. Opinion 512 addressed generative AI but did not contemplate the headless, agentic paradigm. The profession needs a follow-up addressing: privilege implications of autonomous routing, scope of Model Rule 5.3's supervisory obligations when the agent, not the lawyer, selects the vendor,[39] and whether failing to understand the data flow architecture constitutes a competence failure under Model Rule 1.1, Comment 8.[40]

State Bar Ethics Guidance. Does a lawyer waive privilege by using an AI agent that routes privileged information through third-party MCP endpoints without per-endpoint confidentiality agreements? Under Heppner, the answer appears to be yes. Practitioners need that said authoritatively, before the privilege is lost.

EU AI Act. General-purpose AI obligations became applicable August 2025, with high-risk AI system compliance extended under the EU AI Omnibus proposal to late 2027.[32] Cross-border agent workflows may require Standard Contractual Clauses for every MCP connection that crosses a jurisdiction.

The Competence Gap

There is a hard question embedded in all of this: how much technical understanding can we reasonably demand of a practicing attorney?

Model Rule 1.1, Comment 8, tells lawyers to stay abreast of "the benefits and risks associated with relevant technology."[34] But understanding headless architecture, MCP routing protocols, zero-retention verification, and agent audit trail integrity is not the same as learning a new document review platform. A tax partner who has spent twenty years mastering the Internal Revenue Code should not be expected to independently audit the data flow architecture of an AI agent.

This is where vendor responsibility and law firm liability need a clearer line. Today, the vendor sells the tool and the firm assumes the risk. SaaS terms routinely cap damages at twelve months of subscription fees, meaningless against a privilege waiver that costs the client $50 million in litigation.

The profession needs vendors selling into the legal market to provide what I would call a "privilege certificate" for each MCP endpoint, a verified attestation that the endpoint satisfies zero data retention, contractual confidentiality, and audit trail requirements. The firm's obligation: require and verify those certificates. Not independently audit the underlying infrastructure. This is analogous to how firms handle infosec: they require SOC 2 reports rather than conducting their own penetration tests.

Figure: Competence Allocation Framework — Vendor vs. Firm Responsibility

Until this framework exists, the burden falls entirely on the firm. Every firm deploying AI agents in privileged workflows needs someone who can bridge the gap between what the technology does and what the ethics rules require. Not a general IT consultant. Not the vendor's sales engineer. A professional who understands both the agent architecture and the privilege doctrine.

This is, incidentally, a market opportunity. The lawyers and technologists who can read an MCP server specification and a privilege log with equal fluency will be among the most valuable advisors in legal technology for the next decade.

More Architecture, Not Less

There is a persistent narrative that headless software and AI agents will reduce the need for lawyers. The evidence points the other way.

The Wolters Kluwer Future Ready Lawyer Report found significant time savings from AI adoption, yet demand for legal services continued to grow, with firms reporting increased investment in technology-enabled work rather than workforce reduction.[33] AI creates more legal questions than it automates away. Every paradigm shift in this article represents a massive expansion of privilege doctrine, not a threat to it.

The headless era is creating entirely new practice areas: privilege architecture (designing data flows that preserve confidentiality across MCP endpoints), agent governance counsel (evaluating platforms for privilege compliance, drafting endpoint agreements), privilege litigation (defending waiver challenges in an agentic context, novel arguments under both the Gilbarco and Heppner frameworks), and regulatory advocacy (shaping the ABA opinions and bar guidance being written right now).

The Privilege Will Not Preserve Itself

The headless software revolution is here. Salesforce has made its platform headless. MCP has crossed 97 million installs. AI agents are operating in law firms. And the privilege framework that has protected attorney-client confidentiality for centuries was designed for a world where lawyers controlled every disclosure.

That world is gone.

Navin Chaddha described this as "the rise of personalized and headless software in the AI era."[35] He is right about the rise. But personalization without governance is just exposure. And in law, exposure means waived privilege, compromised confidentiality, and professional responsibility violations that no software update can fix.

Plug and play is the promise. Plug and pray is the risk.

What to Do Monday Morning

If you are reading this and wondering where to start, here are six steps ranked by effort:

1. Inventory your agents (1 day). Ask IT for a list of every AI tool, browser extension, and MCP connection active in your environment. Include personal accounts touching firm data. You cannot govern what you have not found.

2. Classify your data flows (1 week). For each tool: Does it retain inputs? Is there a signed confidentiality agreement? Can you produce an audit trail? Any tool that fails all three is a privilege liability.

3. Update your engagement letters (2 weeks). Add disclosure that the firm uses AI agent tools, identify categories of third-party services, describe safeguards, offer opt-outs for sensitive matters. Model Rule 1.6(a)'s informed consent requirement is not optional.

4. Negotiate MCP endpoint agreements (30 days). Standalone confidentiality agreements mirroring outside counsel engagement letter protections, explicit prohibitions on retention, training, third-party access, plus breach notification. Start with the three to five endpoints your agents hit most frequently.

5. Establish privilege-aware routing (60 days). Two-tier architecture: a restricted privilege zone with pre-approved MCP connections only, and a general-purpose zone for non-privileged work. The agent cannot route privileged material outside the restricted zone without human authorization.

6. Designate an AI privilege officer (immediately). Someone who owns the intersection of agent architecture and privilege compliance, reviews new MCP connections before they go live, maintains audit trail infrastructure, and serves as the firm's witness if a privilege challenge reaches a courtroom.

None of these requires you to stop using AI agents. The goal is not to retreat from the technology. It is to adopt it without accidentally waiving the most fundamental protection your clients have.

The agents are already routing. The law needs to catch up. But your firm does not have to wait for the law.

Disclaimer

This article is published for informational and educational purposes only and does not constitute legal advice. The analysis and opinions expressed herein reflect the author's personal views and are not attributable to any firm, client, or organization with which the author is or has been affiliated. Nothing in this article creates an attorney-client relationship, and readers should not act or refrain from acting on the basis of any content herein without seeking independent legal counsel familiar with the specific facts of their situation.

The legal landscape surrounding artificial intelligence, attorney-client privilege, and data privacy is rapidly evolving. Case citations, regulatory positions, and industry data referenced in this article were accurate as of the date of publication and are subject to change. This article does not purport to be a comprehensive survey of applicable law in any jurisdiction.

References to specific companies, products, platforms, and services are for illustrative purposes only and do not constitute endorsement, recommendation, or legal assessment of those entities.

Selected Sources and Further Reading

Headless Architecture and MCP

•  Navin Chaddha, "Founder Insights: Weekend Edition – Issue #29," LinkedIn Pulse (May 9, 2026)

• "Salesforce Launches Headless 360 to Turn Its Entire Platform Into Infrastructure for AI Agents," VentureBeat (April 15, 2026)

• "MCP Hits 97M Installs. Claude Cowork Is Killing Legal SaaS," Abhishek Gautam (April 2026)

• "MCP Security Vulnerabilities: Complete Guide for 2026," Aembit (2026)

• "CIS MCP Security Guide: How to Govern AI Agent Access in Enterprise Environments," Security Boulevard (April 2026)

Privilege and AI: Court Decisions

• United States v. Heppner, S.D.N.Y. (Feb. 17, 2026) — AI conversations not privileged

• Warner v. Gilbarco, Inc., E.D. Mich. (Feb. 10, 2026) — AI-assisted work product protected

• Morgan v. V2X Inc., D. Colo. (Mar. 30, 2026) — AI tools treated as instruments

• "Three Courts, No Consensus: The Evolving Privilege Landscape for GenAI-Generated Legal Materials," Mintz (April 2026)

• "Federal Courts Reach Different Outcomes on Whether AI-Generated Materials Warrant Work Product Protection," Paul Weiss (2026)

Legal Ethics and AI

• ABA Formal Opinion 512: Generative AI Tools (2024)

• "ABA Model Rules 1.1, 1.6, 5.3 and AI: The Legal Ethics Framework Every Law Firm Needs," Claire (2026)

• "Ethical Rules for Using Generative AI: Model Rule 1.6 Confidentiality," Fishman Haygood (2026)

Legal Technology and MCP Adoption

• "Definely Launches MCP and Says 'Don't Ask AI to Check Itself,'" Legal IT Insider (April 30, 2026)

• "General Legal Is the First Law Firm With an MCP Server," Legal MCP (2026)

• "Connect Your Legal Stack to Legora with MCP," Legora (2026)

• "MCP and AI Integration: Legal Risks and Startup Strategy," Traverse Legal (2026)

Enterprise AI Security

• "Shadow AI Morphs Into Shadow Operations," CIO (April 2026)

• "AI Agent Security In 2026: What Enterprises Are Getting Wrong," AGAT Software (2026)

• IBM X-Force 2026 Threat Intelligence Index

Footnotes

[1] "Salesforce Launches Headless 360 to Turn Its Entire Platform Into Infrastructure for AI Agents," VentureBeat (April 16, 2026). "Salesforce has turned its entire platform into infrastructure for AI agents... more than 60 new MCP tools and 30 preconfigured coding skills." Available at https://venturebeat.com/technology/salesforce-launches-headless-360-to-turn-its-entire-platform-into-infrastructure-for-ai-agents.

[2] Navin Chaddha, "Founder Insights: Weekend Edition – Issue #29," LinkedIn Pulse (May 9, 2026). "This is the rise of personalized and headless software in the AI era. Power is transferring from software to agents." Available at https://www.linkedin.com/pulse/founder-insights-weekend-edition-issue-29-navin-chaddha-5znjc/.

[3] Chaddha, Issue #29 (May 9, 2026): "Think USB-C for AI: one open standard that connects a single agent to every app, database, and service you use." Available at https://www.linkedin.com/pulse/founder-insights-weekend-edition-issue-29-navin-chaddha-5znjc/.

[4] "MCP Hits 97M Installs," Abhishek Gautam (April 2026): "MCP crossed 97 million installs in April 2026, up from under 5 million six months prior." Available at https://www.abhs.in/blog/mcp-97-million-installs-claude-cowork-saaspocalypse-legal-tech-2026.

[5] "Definely Launches MCP and Says 'Don't Ask AI to Check Itself,'" Legal IT Insider (April 30, 2026). Troutman Pepper Locke quoted welcoming the MCP launch alongside its proprietary Enterprise AI agent Athena. Available at https://legaltechnology.com/2026/04/30/definely-launches-mcp-and-says-dont-ask-ai-to-check-itself/.

[6] Gartner Press Release (August 26, 2025): "Gartner Predicts 40 Percent of Enterprise Apps Will Feature Task-Specific AI Agents by 2026, Up from Less Than 5 Percent in 2025." Available at https://www.gartner.com/en/newsroom/press-releases/2025-08-26-gartner-predicts-40-percent-of-enterprise-apps-will-feature-task-specific-ai-agents-by-2026-up-from-less-than-5-percent-in-2025.

[7] Deloitte 2026 TMT Predictions: global agentic AI market projected at $8.5B in 2026, potentially $35B by 2030. 75% of companies expected to invest in agentic AI. Available at https://www.deloitte.com/global/en/about/press-room/2026-tmt-predictions.html.

[8] Gartner (June 2025): "Over 40% of agentic AI projects will be canceled by end of 2027 due to escalating costs, unclear business value, or inadequate risk controls." Available at https://www.gartner.com/en/newsroom/press-releases/2025-06-25-gartner-predicts-over-40-percent-of-agentic-ai-projects-will-be-canceled-by-end-of-2027.

[9] VentureBeat (April 15, 2026): headline and analysis of Salesforce Headless 360 announcement. Available at https://venturebeat.com/technology/salesforce-launches-headless-360-to-turn-its-entire-platform-into-infrastructure-for-ai-agents.

[10] "General Legal Is the First Law Firm With an MCP Server," Legal MCP (2026). Available at https://legalmcp.org/.

[11] Legal IT Insider (April 30, 2026), supra note 5.

[12] "Connect Your Legal Stack to Legora with MCP," Legora (2026). Available at https://legora.com/blog/connect-your-legal-stack-to-legora-with-mcp.

[13] United States v. Heppner, S.D.N.Y. (Feb. 17, 2026). See Harvard Law Review analysis, available at https://harvardlawreview.org/blog/2026/03/united-states-v-heppner/.

[14] Client alerts published by K&L Gates (Feb. 23, 2026), Duane Morris (March 2026), Greenberg Traurig (April 2026), DLA Piper (February 2026), Ogletree Deakins (2026), and Perkins Coie (2026). See, e.g., K&L Gates, "Litigation Minute: Generative AI Data, Attorney-Client Privilege, and the Work-Product Doctrine," available at https://www.klgates.com/Litigation-Minute-Generative-AI-Data-Attorney-Client-Privilege-and-the-Work-Product-Doctrine-2-23-2026.

[15] Heppner, slip op. (S.D.N.Y. Feb. 17, 2026). The court stated that Heppner "does not, and indeed could not, maintain that Claude is an attorney." See Debevoise analysis, available at https://www.debevoisedatablog.com/2026/02/17/update-judge-rakoff-issues-written-opinion-that-ai-generated-documents-are-not-protected-by-privilege/.

[16] Debevoise analysis (Feb. 17, 2026): noting that the court examined Anthropic's privacy policy, which states that it collects user "inputs" and "outputs" and uses that data to "train" Claude, concluding there was no reasonable expectation of confidentiality. Available at

https://www.debevoisedatablog.com/2026/02/17/update-judge-rakoff-issues-written-opinion-that-ai-generated-documents-are-not-protected-by-privilege/.

[17] Warner v. Gilbarco, Inc., E.D. Mich. (Feb. 10, 2026). See Perkins Coie analysis: "the work product doctrine protected a pro se litigant's AI-assisted drafting materials precisely because the doctrine shields a party's litigation-related thought processes regardless of the medium through which they are expressed." Available at https://perkinscoie.com/insights/update/heppner-and-gilbarco-courts-apply-privilege-and-work-product-protection-generative.

[18] Morgan v. V2X Inc., D. Colo. (Mar. 30, 2026). See Paul Weiss analysis, available at https://www.paulweiss.com/insights/client-memos/federal-courts-reach-different-outcomes-on-whether-ai-generated-materials-warrant-work-product-protection.

[19] Paul Weiss (2026): "Federal Courts Reach Different Outcomes on Whether AI-Generated Materials Warrant Work Product Protection." Available at https://www.paulweiss.com/insights/client-memos/federal-courts-reach-different-outcomes-on-whether-ai-generated-materials-warrant-work-product-protection.

[20] "Three Courts, No Consensus: The Evolving Privilege Landscape for GenAI-Generated Legal Materials," Mintz (April 29, 2026). Available at https://www.mintz.com/insights-center/viewpoints/54731/2026-04-29-three-courts-no-consensus-evolving-privilege-landscape.

[21] ABA Formal Opinion 512 (2024): lawyers using generative AI must comply with Model Rule 1.6's duty of confidentiality. See https://www.americanbar.org/news/abanews/aba-news-archives/2024/07/aba-issues-first-ethics-guidance-ai-tools/.

[22] ABA Formal Opinion 512, discussing factors lawyers must evaluate before inputting client information into AI tools. Available at https://www.americanbar.org/news/abanews/aba-news-archives/2024/07/aba-issues-first-ethics-guidance-ai-tools/.

[23] ABA Model Rule 5.3: supervisory responsibilities regarding nonlawyer assistance, including technology service providers. Available at https://www.americanbar.org/groups/professional_responsibility/publications/model_rules_of_professional_conduct/rule_5_3_responsibilities_regarding_nonlawyer_assistant/.

[24] Gravitee 2026 survey: "Only 24.4% of organizations have full visibility into which AI agents are communicating with each other." Cited in "MCP Security Vulnerabilities: Complete Guide for 2026," Aembit. Available at https://www.gravitee.io/state-of-ai-agent-security.

[25] Chaddha, Issue #29 (May 9, 2026): "SAP moves to block unauthorized AI agents across its platforms." Available at https://www.linkedin.com/pulse/founder-insights-weekend-edition-issue-29-navin-chaddha-5znjc/.

[26] "MCP Hits 97M Installs. Claude Cowork Is Killing Legal SaaS," supra note 4, describing a "SaaSpocalypse" in legal technology. Available at https://www.abhs.in/blog/mcp-97-million-installs-claude-cowork-saaspocalypse-legal-tech-2026.

[27] "Shadow AI Morphs Into Shadow Operations," CIO (April 2026). Available at https://www.cio.com/article/4162664/shadow-ai-morphs-into-shadow-operations.html.

[28] IBM X-Force 2026 Threat Intelligence Index: 44% surge in exploitation of public-facing applications. Available at https://www.ibm.com/reports/threat-intelligence.

[28a] Security research documenting over 12,000 API keys and passwords exposed through insecure MCP credential handling. See "MCP Security Vulnerabilities," Datastealth (2026). Available at https://datastealth.io/blogs/mcp-security. See also Aembit, "The Ultimate Guide to MCP Security Vulnerabilities" (2026), available at https://aembit.io/blog/the-ultimate-guide-to-mcp-security-vulnerabilities/.

[29] "CIS MCP Security Guide: How to Govern AI Agent Access in Enterprise Environments," Security Boulevard (April 2026). Available at https://securityboulevard.com/2026/04/cis-mcp-security-guide-how-to-govern-ai-agent-access-in-enterprise-environments/.

[30] Legal IT Insider (April 30, 2026), supra note 5: Definely's stated philosophy of "don't ask AI to check itself." Available at https://legaltechnology.com/2026/04/30/definely-launches-mcp-and-says-dont-ask-ai-to-check-itself/.

[31] See "OpenClaw Dashboard: Your Complete Guide to Monitoring AI Agents in 2026," OpenClawForge (2026), describing agent observability platforms that provide "session activity, API costs, system health, and memory usage in one unified view." Available at https://openclawforge.com/blog/openclaw-dashboard-complete-guide-monitoring-ai-agents-2026/. See also Navin Chaddha, "The OpenClaw Ecosystem," LinkedIn Pulse (March 25, 2026), mapping the observability layer. Available at https://www.linkedin.com/pulse/openclaw-ecosystem-navin-chaddha-wypdc.

[32] EU AI Act, Article 99. General-purpose AI obligations became applicable August 2, 2025. The original August 2026 deadline for high-risk AI systems has been extended under the EU AI Omnibus proposal. See DLA Piper, "Latest Wave of Obligations Under the EU AI Act Take Effect" (August 2025), available at https://www.dlapiper.com/en-us/insights/publications/2025/08/latest-wave-of-obligations-under-the-eu-ai-act-take-effect. Timeline: https://artificialintelligenceact.eu/article/99/. Also, refer to https://www.gdprregister.eu/articles/eu-ai-act-update-new-deadlines/.

[33] Wolters Kluwer Future Ready Lawyer Report 2026: reports significant AI adoption and time savings across firms, with continued investment growth in technology-enabled legal services. Available at https://www.wolterskluwer.com/en/know/future-ready-lawyer-2026.

[34] ABA Model Rule 1.1, Comment 8: duty of competence extends to keeping abreast of "the benefits and risks associated with relevant technology." Available at https://www.americanbar.org/groups/professional_responsibility/publications/model_rules_of_professional_conduct/rule_1_1_competence/comment_on_rule_1_1/.

[35] Chaddha, Issue #29 (May 9, 2026), supra note 2.

[36] William Chen, "Mike OSS" launch announcement, LinkedIn (May 2026). "Harvey is valued at $11B. Legora just raised at $5.5B. I built their entire web application in two weeks and I'm making it open-source and free for everyone to use." Available at https://mikeoss.com/.

[37] "Mike OSS: Open Source Legal AI Tool 'Changes the Negotiation,'" Legal IT Insider (May 5, 2026). "On GitHub, Mike had more than 1000 stars and over 300 forks 72 hours after launch, the most for any legal tech project in history." Available at https://www.artificiallawyer.com/2026/05/04/mike-the-open-source-legal-ai-platform-will-chen-interview/.

[38] ABA Model Rule 1.6(a): "A lawyer shall not reveal information relating to the representation of a client unless the client gives informed consent, the disclosure is impliedly authorized in order to carry out the representation or the disclosure is permitted by paragraph (b)." Available at https://www.americanbar.org/groups/professional_responsibility/publications/model_rules_of_professional_conduct/rule_1_6_confidentiality_of_information/.

[39] ABA Model Rule 5.3(b): "a lawyer having direct supervisory authority over the nonlawyer shall make reasonable efforts to ensure that the person's conduct is compatible with the professional obligations of the lawyer." Available at https://www.americanbar.org/groups/professional_responsibility/publications/model_rules_of_professional_conduct/rule_5_3_responsibilities_regarding_nonlawyer_assistant/.

[40] ABA Model Rule 1.1, Comment 8: "To maintain the requisite knowledge and skill, a lawyer should keep abreast of changes in the law and its practice, including the benefits and risks associated with relevant technology, engage in continuing study and education and comply with all continuing legal education requirements to which the lawyer is subject." Available at https://www.americanbar.org/groups/professional_responsibility/publications/model_rules_of_professional_conduct/rule_1_1_competence/comment_on_rule_1_1/.

[41] ABA Model Rule 1.6, Comment 5: "Except to the extent that the client's instructions or special circumstances limit that authority, a lawyer is impliedly authorized to make disclosures about a client when appropriate in carrying out the representation." Explicit informed consent under Rule 1.6(a) permits broader disclosures beyond those impliedly authorized. Available at https://www.americanbar.org/groups/professional_responsibility/publications/model_rules_of_professional_conduct/rule_1_6_confidentiality_of_information/comment_on_rule_1_6/.