Last updated 2026-09-01 · v0.14.1 · draft · this document evolves, see Changelog

This guide is for people who use AI, work at companies that are figuring out AI, or practice law in a world where AI is already reshaping billable work. Skip to the part that fits you. Everyday users start at Part 2. Companies start at Part 3. Big Law starts at Part 4. Developers start at Part 5. Part 1 is background: read it if you want the landscape first, skip it if you want to get to work.

Part 1: The AI landscape in 2026

If you only read one part of this guide, read this one. It explains what these tools are, who makes them, what they cost, and how the ground shifted in the last six months. Everything after Part 1 assumes you have this picture in your head. I have kept the jargon out and the dates in.

1.1 What a language model is, plainly

Think of a language model as the most well-read intern you have ever met, one who has skimmed most of the public internet and recalls the shape of everything while recalling the details of almost nothing. You hand it the start of a thought, and it continues that thought the way a careful writer would. That continuation is the whole trick. Drafts, summaries, translations, contract markups, working code: all of it comes out of one move, repeated a few thousand times a second.

The model is good at a surprising range of work. It rewrites a clumsy paragraph into a clean one. It reads an 80-page lease and pulls out the ten clauses that could hurt you. It turns your half-formed idea into a first draft you can argue with. It explains a tax concept three different ways until one of them lands. It reasons step by step through a problem you describe, as long as the problem lives in words.

But the model cannot do several things people assume it can. It does not look anything up unless you connect it to a tool that searches. It does not remember your last conversation unless you turn on memory. It does not know today's news, your company's private files, or the contents of a document you have not shown it. And it does not actually know what it knows. Ask it a question it cannot answer, and it rarely says so. It writes a confident answer anyway.

That last trait is the one that catches people. The model picks the most plausible next words, not the true ones. When the facts are missing, it fills the gap with text that has the right shape: a citation that looks real, a statute number that parses, a statistic that sits in a believable range. The output reads as authoritative because reading authoritative is exactly what it was trained to do. The industry calls this hallucination, and it is not a bug the next release fixes. It is a side effect of how the thing works.

Even measured carefully, the productivity picture is unsettled. A 2025 randomized study of 16 experienced open-source developers completing 246 tasks in repositories they knew found that early-2025 AI tools made them 19% slower, although they expected to be faster.[98] METR's February 2026 follow-up then measured the same developers roughly 18% faster with late-2025 tools and newly recruited developers about 4% faster, with intervals wide enough to include zero.[99] METR calls that new data an unreliable signal, mainly because developers began declining to participate rather than work without AI, a bias it says pushes the estimate down, so the true speedup is probably larger.[99] Neither wave generalizes to every developer, model, or codebase. The durable finding is the gap between felt speed and measured speed. The lesson holds beyond code: the tool is genuinely useful and genuinely fallible, often in the same sentence.

So the practical question is never "is AI smart." The practical question is "is this specific task one where a fast, fluent, occasionally-wrong intern helps me or hurts me." The rest of this guide answers that question for three kinds of reader. Everyday users learn which tool to open and how to get more from it. Companies learn where the cheap, provable wins are. Lawyers learn where the malpractice traps hide. Builders learn how to wire these models into real software. Read on for the landscape, then jump to the part that fits you.

1.2 The five families that matter: OpenAI, Anthropic, Google, xAI, Meta

Five labs ship the models almost everyone uses. They trade the lead every few weeks, and no single model wins every task, so treat the rankings below as a snapshot from August 31, 2026, not a permanent order. Where benchmarks are contested, I say so rather than pick a winner.

The summer of 2026 changed the shape of this list more than the order of it. Every lab now ships a tiered family rather than a single flagship, and the tiers are priced far apart. You choose a capability level and a price at the same time, on the same model line. That is the single most useful thing to understand before reading the rest of this section.

OpenAI: the GPT-5.6 family, plus Codex as the work surface. OpenAI's current line is GPT-5.6, which went generally available on July 9, 2026 in three tiers: Sol at the top, Terra in the middle, and Luna at the bottom.[241] It replaced GPT-5.5 (April 23, 2026), which sat on a ladder running back through GPT-5.2 in December 2025 and GPT-5 in August 2025.[45][9] GPT-5.5 remains the reference point for OpenAI's strongest published job-task result: on the lab's own GDPval test it scored 84.9%, leading the field across the test's 44 real occupations.[8] The weakness has not changed, and it is the same weakness every lab has. The lead is narrow and the benchmarks come from the company that profits from them.

Pricing dropped sharply this summer, in two separate steps that are worth keeping apart. On July 30, 2026, OpenAI cut Terra by roughly a fifth and Luna by roughly 80%, to $2 and $12 and to $0.20 and $1.20. Sol was not part of that cut and held at $5 and $30. Sol came down separately on August 21, 2026, to $4 and $20. OpenAI says that promotional rate will remain available at least through November 21, 2026, but it has not announced the later price.[241] For requests above 272,000 input tokens, OpenAI charges twice the input rate and 1.5 times the output rate. Cache reads can cost one tenth of standard input, while cache writes can cost 1.25 times standard input. Batch pricing depends on model and endpoint, so check the current pricing page before treating any discount as universal.[241] In the chat app, Plus is about $20 a month, Go is $8, and Pro comes in two tiers: $100 a month for five times the limits and $200 for twenty times.[17][253]

The product shift is Codex: OpenAI now sells an agent workspace, not just a model, with desktop agents, ChatGPT workspace agents, scheduled work, approvals, admin controls, and analytics.[225][226][238] It also now sells people. On May 11, 2026, OpenAI launched the OpenAI Deployment Company, a professional services business backed by more than $4 billion from nineteen investment firms, consultancies, and systems integrators, and majority-owned by OpenAI. It embeds "forward deployed engineers" inside customer organizations, and it opened with roughly 150 of them through the acquisition of the consultancy Tomoro.[247] For a firm evaluating vendors, that matters: the model provider is now also a competitor to the systems integrator you might have hired to deploy it.

Anthropic: Claude Opus 5, with Fable 5 above it and Sonnet 5 below. Anthropic shipped four Claude 5 models in under two months, and the one most firms should default to is Claude Opus 5, released July 24, 2026.[239] Anthropic claims it lands within 0.5% of Fable 5's peak score on the CursorBench 3.2 coding benchmark at maximum effort, at half the cost per task, and that it more than doubles Opus 4.8 on Frontier-Bench v0.1 for the same price.[239] Those are the lab's own numbers on the lab's own chosen tests, so weigh them as claims rather than findings. Opus 5 runs thinking on by default and carries a 1M-token context window with 128K max output.[239]

Claude Fable 5, generally available June 9, 2026, remains the most capable model Anthropic sells widely, and it still leads Opus 5 on some narrow tasks.[223][239] Claude Sonnet 5 is the volume tier. Below both sits Claude Haiku 4.5 for cheap, fast, simple work.

The pricing tells you how to use the family. Fable 5 costs $10 per million input tokens and $50 per million output. Opus 5 and Opus 4.8 both cost $5 and $25. Sonnet 5 costs $2 and $10, and that price is now permanent: the increase to $3 and $15 that Anthropic had scheduled for September 1, 2026 was cancelled. Haiku 4.5 costs $1 and $5.[240] Opus 5 also exposes an effort setting (low through max) that trades tokens against thoroughness on the same model, which is usually a cheaper lever than dropping to a weaker model.[239]

The weakness across the family is still cost. Heavy agent use adds up fast, and quality can drift in very long sessions.

Google: Gemini 3.7 Flash, with Antigravity as the agent layer. Google's newest model is Gemini 3.7 Flash, which the company describes as its most intelligent workhorse model rather than its flagship.[242] The Pro line is still nominally the top tier, but 3.7 Flash outscores Gemini 3.1 Pro on several published indices while costing a fraction as much, so for most work it is the one to reach for.[242] Its genuine edge has not changed: one model reads text, images, video, audio, and PDFs together, which makes it the easiest choice when your material is not just words. It is also the cheapest frontier tier by a wide margin. Gemini 3.7 Flash and 3.6 Flash both run $0.75 per million input tokens and $3.75 per million output, but that is introductory pricing through December 31, 2026, and it rises to $1.50 and $7.50 on January 1, 2027.[242] Budget on the January number, not the current one. Gemini 3.1 Pro is still in preview at $2 and $12, and the older 3.5 Flash sits at $1.50 and $9.[242]

The caveat is unchanged: the much-cited reasoning scores are Google's own, measured Google's way, and the higher numbers you may see come from a separate, slower "Deep Think" mode.[25] Gemini 4 has been confirmed as in pre-training with no announced release date, specifications, or pricing, so treat any Gemini 4 claim you encounter as speculation.[242] Google's agent story runs through Antigravity and Managed Agents: one call can spin up an agent in an isolated Linux environment, with tools, code execution, and markdown-defined agent files.[236]

xAI: Grok 4.6. xAI's current flagship is Grok 4.6, released August 12, 2026 and aimed at long-running agents and interactive or visual work.[243] It costs $2 per million input tokens and $6 per million output, with a faster variant at double that.[243] It is best at three things: live data from X, fewer content guardrails than its rivals, and agentic work at a mid-range price. Its context window is reported at 500,000 tokens, the smallest of the current frontier models, which now sit at or above 1M.[243] For a lawyer feeding in a full production set, that ceiling matters more than the price does.

The predecessor Grok 4.3, which reached the public API on April 30, 2026 at $1.25 and $2.50, still holds the cheapest frontier output price and ranked first on Vals AI's Case Law v2 legal-reasoning benchmark at 79.3%.[202][203] That is a benchmark provider's own result rather than an independent courtroom test, and no published Case Law result yet covers Grok 4.6, so do not assume the legal- reasoning ranking carried forward. xAI's consumer pricing remains murky. Grok 4 launched in July 2025 alongside a $300-a-month SuperGrok Heavy tier.[47]

Meta: Muse Spark and Llama. Meta's consumer flagship is Meta AI powered by Muse Spark, announced April 8, 2026 as the first model from Meta Superintelligence Labs.[41] Meta also returned to genuine open source in August. Muse Glimmer, released August 10, 2026, is a 30-billion-parameter agent-optimized model under an unmodified Apache 2.0 license, which makes it meaningfully more permissive than anything in the Llama line.[244] A coding-focused Muse Spark 1.2 with a 1M-token context window is reported for August 5, 2026, and Meta has said its weights are "coming soon" without naming a date or a license, so treat Spark 1.2 as closed-weight until Meta says otherwise.[244] Llama 4 remains Meta's established open-weight family, the models you can download and run on your own hardware.[38]

Meta is best at two unglamorous things: a free assistant living inside WhatsApp, Instagram, and Facebook, and open weights for anyone who wants to self-host. The weaknesses are that public detail on the Muse line stays thin, and Llama is "open weight," not fully open source: a company with more than 700 million monthly active users needs a separate license.[219] For most people, both are free.

The pattern across all five is specialization, not dominance. Coding leads are often three or four points apart on the standard tests, and the same model can top one benchmark while trailing on the next.[26] Pick the model that fits the task in front of you, and re-check the ranking in a couple of months, because it will have moved.

1.3 Free vs paid: where the real lines are

Every major lab gives you a real free tier, and for a lot of everyday use the free tier is enough. You get a capable chat assistant, usually running a smaller or older model, with daily usage caps and limited or no access to web search, file uploads, memory, and connectors. If you ask a few questions a day and never hand the model your own documents, you may never need to pay.

You cross into paid territory when you need one of five things: the newest frontier model, higher usage limits, longer context for big documents, the ability to connect the model to your files and apps, or persistent memory across sessions. Most people who pay are buying limits and frontier quality, not a secret feature.

Two pricing models sit underneath everything, and confusing them wastes money. Per-seat pricing is a flat monthly fee per person, the way Netflix charges. It fits humans clicking buttons in a chat window. Per-use pricing, billed per million "tokens" (roughly, per few hundred thousand words in and out), fits software that calls the model automatically. A team of ten people drafting emails wants per-seat subscriptions. A nightly script that summarizes a thousand documents wants per-use API billing. Pick the wrong one and you either cap your people or torch your budget.

Consumer subscriptions, as of August 31, 2026:

Three of the four paid vendors have now converged on the same shape: a ~$20 everyday tier, then 5x and 20x usage multipliers at roughly $100 and $200.[253] That convergence is useful, because it means you can compare tiers across vendors on usage rather than on marketing names. These figures come from aggregator tracking rather than a single vendor page, so confirm the current number on the vendor's own pricing page before you commit a budget.

Business per-seat pricing, where the lines are sharper:

For builders paying per use, the API token prices (per million tokens, input then output) tell the real cost story:

Two numbers reframe the rest. The spread between the most and least expensive output in that table is more than forty to one, and the gap on the benchmarks between the top and the middle is a few points. Match the model to the job, and save the expensive model for the work that earns it.

Do not apply one provider's discount rules to another provider. OpenAI's GPT-5.6 Sol page, for example, distinguishes cache reads from more expensive cache writes and adds separate input and output surcharges above 272,000 input tokens. Google and xAI use different thresholds and storage rules. Anthropic offers cache and Batch discounts on eligible models, plus an effort setting on its newest models. Price the exact model, context length, cache operation, endpoint, and processing mode you will use.[239][240][241][242][243]

1.4 The three biggest shifts of the last six months

Three changes since late 2025 matter more than any single model release. The first changed how AI remembers. The second changed how it works. The third changed where AI work happens: from one chat box into operating surfaces that coordinate context, tools, agents, and model comparisons. All three started with practitioners, not press releases, and all three are simple enough to use this week.

Every major lab shipped a new model between this version and the last one, and most cut prices. None of that changed how anyone should work. The three shifts below did. When you are deciding what to pay attention to, that is the test worth applying: a new model changes what you can afford, but a new way of working changes what you do.

1.4.1 Knowledge bases (Karpathy's wiki): why it changed everything

The shift started with a post. On April 3, 2026, Andrej Karpathy described on X how he uses a language model to build and maintain a personal knowledge base, and the next day he published a short companion gist.[55][56] Developers seized on it within days. The idea is small and the payoff is large: instead of asking the model to fish facts out of a pile of documents on every question, you let the model build and keep a tidy wiki of its own.

The structure has three layers. A raw/ folder holds your original sources, untouched. A wiki/ folder holds clean pages the model writes and rewrites: one page per topic, per source, per open contradiction. A schema file (in Karpathy's setup, CLAUDE.md) tells the model what every page must contain and how the layers relate. I call this the functional triad: raw evidence, model-written knowledge, and a human-governed schema. Three operations keep it alive: ingest a new source, query the wiki to answer a question, and lint it to catch missing provenance, stale claims, and conflicts. Newer implementations make the provenance mechanical by requiring every wiki page to name its raw sources and by retaining disputed or outdated claims with status labels instead of silently replacing them.[286] Karpathy's own line on who does the work: "The LLM writes and maintains all of the data of the wiki. I rarely touch it directly."[128]

Here is what it fixes. The older approach, called RAG (retrieval-augmented generation), grabs raw chunks of your documents fresh on every question and forgets them the moment it answers. It is, in effect, amnesiac: it never learns, it just re-reads.[127] A maintained wiki does the opposite. Knowledge compounds. The model writes down what it figured out last week, reconciles a new source against the old ones, and starts the next question already smarter. For a personal or team-sized body of knowledge, plain markdown files plus a long-context model beat a complicated database.

This guide lives inside exactly such a setup. The repository you are reading from keeps source material under raw/, and the AI helps build structured notes alongside it. That is not a coincidence or a flex. It is the cheapest way I have found to keep a growing pile of research usable. You do not need to be a programmer to copy the pattern. A folder of plain text files, a chat model with file access, and three habits (add sources, ask questions, prune contradictions) get you most of the value. People report large wikis built this way on a single topic, though the exact sizes that circulate online are hard to verify, so treat those numbers with care.

1.4.2 Agentic loops (/goal, Ralph loops): why iteration beats one-shot

The second shift is about persistence. For most of the chatbot era, you asked one question and got one answer. An agentic loop changes the rhythm: the model takes a goal, does some work, checks its own result, and tries again, over and over, until the goal is met or it runs out of budget. Geoffrey Huntley named the bare-bones version of this pattern the "Ralph loop," a tight cycle where an agent re-reads its instructions and edits files using the filesystem as its memory.[62] The technique predates the products by more than a year.

In the last six months the labs baked it in. OpenAI shipped Codex CLI version 0.128.0 on April 30, 2026 with a built-in /goal command.[60] Under the hood it works through two template files, continuation.md and budget_limit.md: after each turn the agent is nudged to keep going toward the goal or to stop when it hits a token ceiling.[60] Simon Willison covered the release the day it landed.[58] Anthropic shipped its own official "ralph-wiggum" plugin for Claude Code in December 2025, folding Huntley's filesystem loop into the tool through its stop-hook system.[187]

What this makes possible is long-horizon work that no single prompt could finish: migrating a large codebase, repairing a broken test suite, or running an overnight build while you sleep. The model keeps its own progress notes in files and picks up where it left off.

But the failure modes are real and expensive. If the test the agent checks itself against is broken, /goal will happily burn 200,000 tokens trying to "fix the build" and get nowhere. Loops get stuck on a locked file, the wrong model, or context that has grown so long the model loses the thread. The better Ralph implementations now treat the loop as a small state machine: one backlog item, one fresh session, one objective check, one recorded state change, then repeat. They separate the task list, execution prompt, and learned guardrails, and they stop on repeated output or lack of progress.[284][285] That fresh context matters because the filesystem carries the durable state while each model run starts clean.

The rule that falls out of this: an agentic loop is only as good as its backpressure. Give it a reliable test, a bounded task, a stall detector, and a hard budget. A bad eval and a blank check let it spend money while going nowhere.

1.4.3 Agent operating surfaces: why one chat is no longer the unit

The third shift is that the unit of work is moving above the individual chat. A modern AI workflow may keep a project knowledge base, call tools, spawn scoped sub-agents, run browser actions, compare multiple models, and write a durable artifact at the end. The chat transcript is only one surface of the work.

The official product launches now make that visible. OpenAI's workspace agents are shared, Codex-powered agents that run in ChatGPT and Slack, can operate on schedules, ask for approvals, and expose analytics to admins.[226][238] Google's Managed Agents run the Antigravity harness in a cloud sandbox, with tools, code execution, and agent definitions stored in files.[236] Anthropic's Skills make the same point from the instruction side: reusable work belongs in a small, tested bundle with scripts and resources, not in a prompt you rewrite every time.[237]

Practitioner signals point in the same direction, but they should not be treated as product facts. OpenRouter's June 2026 description of Fusion shows one prompt fanning out to a panel of models while a judge model synthesizes consensus, contradictions, missing coverage, and unique insights.[206] Browser-skill products package repeatable web actions as reusable skills instead of bespoke prompts.[212] Neither product is the final form. Serious AI use is becoming a small operating system: memory, tools, model routing, review, and logs.

For buyers, the best answer may no longer come from the "best" single model. It may come from the workflow that gets three different models to disagree in useful ways, routes the mechanical work to cheap models, and reserves the expensive frontier model for judgment. It matters for lawyers because these surfaces create the audit trail the profession needs: what context was used, what tools ran, what models were consulted, and who approved the final output.

1.5 A 10-minute self-test: is this AI a fit for what I'm doing?

Before you reach for AI on a task, run it through this quick branch. Each branch ends with a verdict and points you to the part of the guide that goes deeper.

Is the task about writing, summarizing, explaining, or reshaping text I can give the model? If yes, the fit is strong. This is the core competence: drafting, editing, translating, turning long into short. Go to Part 2.

Does it depend on current facts, live prices, or recent news? If yes, the fit is conditional. Use a model with live web search and citations (Perplexity or Gemini with grounding), and verify anything that matters. A closed chat model will guess. Part 2.5 compares the research tools.

Does it need a specific fact stated exactly right, like a legal citation, a dosage, or a statistic I cannot check? If yes, the fit is poor without verification. This is the hallucination zone, and it is where the Mata v. Avianca sanctions came from. Use AI to draft, then confirm every hard fact against a primary source. Lawyers, see Part 4.7.

Is it a repeating business task across a team, like email, intake, or status updates? If yes, the fit is strong, but the win comes from setup, not magic. Build shared prompts and shared context once. Go to Part 3.

Does it involve my company's private documents or my clients' confidential data? If yes, the fit depends entirely on the tool's privacy terms. Use an enterprise tier with no training on your data, and read the contract. Part 2.7 covers the basics, and Part 4.6 covers the legal duties.

Am I trying to build software, automate a workflow, or wire a model into other systems? If yes, the fit is strong and the ceiling is high, but you are now a builder. If you are not sure you need code yet, read §3.6 first (it draws the line between staying in the chat UI and bringing in a developer). When you do need code, plan first, scaffold deliberately, and watch your token budget. Go to Part 5.

If none of these quite fit, the honest answer is to try it on a small, low-stakes version of the task and judge the result yourself. Ten minutes of testing beats ten minutes of theorizing.

And if you are a regular person who just wants to get more out of the chat window you already pay for, go to Part 2 next. Companies, Part 3. Lawyers, Part 4. Builders, Part 5. The landscape is behind you now. The rest is practice.

Part 2: The everyday user track

This track is a ladder, not a single step. You start by picking one chat app and using it daily (§2.1), add the workflows that earn back the subscription (§2.2–§2.5), then give it memory and your own files so it stops starting from scratch (§2.6). The last section (§2.12) shows how to graduate from plain chat to an agent that runs work for you, and points the way into the company and builder tracks when you outgrow chat entirely. Read it top to bottom the first time, then come back to the rung you need.

2.1 Pick your default chat

Pick one chat app, pay for it, and use it every day for a month. The habit matters more than the choice. All four major consumer chats are good enough now that your fluency with one beats the small quality gaps between them.

If you want a recommendation, here is the short version. Claude for writing and thinking through problems in prose. ChatGPT for general use and anything that touches your inbox. Gemini if you live in Gmail, Docs, and Android. Grok if you want live data from X and fewer guardrails. No single model wins every task, and that specialization is the defining feature of 2026.[133]

The prices cluster tightly at the entry level. ChatGPT Plus and Claude Pro both run about $20 a month, and Google's AI Pro is $19.99.[17][44][27] The free tiers are genuinely useful, so start there and upgrade only when you hit limits. The expensive tiers are for heavy users: ChatGPT Pro at $100 or $200 a month, Google AI Ultra at $99.99 or $199.99, and xAI's SuperGrok Heavy at $300, the priciest consumer tier among the majors.[17][29][47]

One recent change is worth knowing. OpenAI made GPT-5.5 Instant the default model in ChatGPT on May 5, 2026, and pitched it as less prone to making things up in areas like law and medicine.[46] If you tried ChatGPT a year ago and found it unreliable, the floor has moved.

The honest answer to "which one" is to try two for a week each and keep the one whose answers you trust. Fluency compounds. Someone who knows exactly how to ask their one tool will out-produce someone who keeps switching.

2.2 Five everyday workflows that pay for the subscription

Five workflows earn back a $20 subscription in the first week. None of them require any technical skill.

Drafting the email you keep putting off. The blank page is the expensive part. Paste the thread, say what outcome you want and what tone, and ask for a draft. You edit instead of compose, which is faster and less draining. ChatGPT and Gemini are convenient here because they sit close to your inbox.

Summarizing long documents you do not have time to read. Paste a 40-page lease, contract, or report and ask for the ten things that matter plus anything that looks like a risk. Claude suits this well because it handles very long inputs and produces long, structured outputs.[1] Always read the source for anything you will act on, but a good summary tells you where to look.

Turning a mess of notes into a clean draft. Meeting notes, voice memos, scattered bullet points. Hand the model the raw pile and ask for a structured version: agenda, decisions, action items. This is the workflow that quietly saves the most time per week.

Research you would otherwise farm out to a search engine and ten browser tabs. Ask a grounded research tool a real question and get a synthesized answer with sources. More on the specific tools in 2.5.

Explaining something until you actually understand it. A tax form, a medical result, a clause in a contract, a line of code. Ask for a plain explanation, then ask follow-ups until it clicks. The model never tires of the third "but why," and it does not judge you for asking.

The pattern across all five is the same. The AI removes the cost of starting. That is worth more than any single impressive output, because the tasks you avoid are usually the ones a subscription pays you back on.

2.3 Image generation: nano-banana, ChatGPT, when to use which

Two tools cover almost everything. Use Google's Nano Banana for a strong first image, and use ChatGPT when you need to change one thing at a time.

Google's image model, nicknamed Nano Banana (the current version is Nano Banana 2), became Gemini's default image generator on February 26, 2026.[26] It is the one to reach for when you want a polished result on the first try. It renders legible text inside images better than its rivals, handles photorealism well, and keeps a character looking consistent across a series of images.[26] Every image it makes carries an invisible SynthID watermark, so it can be identified as AI-generated later.[220]

It has a real limit, and Google says so. It can still misspell small text and get the numbers in an infographic wrong.[26] Check any image you will publish, especially anything with text or data in it.

ChatGPT's image tool is the other strong choice for iterative editing: keep an image and change exactly one thing ("same photo, make the jacket red") while the rest of the picture holds steady. Google built Nano Banana for the same kind of multi-turn editing, so as of mid-2026 both handle this job well. If your workflow is generate, react, adjust, adjust again, try each on your own images and keep whichever holds detail better for your case.

You do not pay separately for either. Image generation comes bundled in the subscriptions from 2.1: ChatGPT Plus at about $20 a month, and Google's AI tiers starting at $19.99.[17][27]

When to use which, in one line: Nano Banana for the first great image, ChatGPT to refine a specific one.

2.4 Voice modes and assistants

Voice is the mode most people try once and forget, which is a mistake. Talking to an AI beats typing for a whole class of tasks: thinking out loud, practicing a hard conversation, or getting an explanation while your hands are busy.

The two consumer voice modes worth knowing are ChatGPT's Advanced Voice and Google's Gemini Live. Both let you hold a natural back-and-forth, interrupt mid-sentence, and switch topics without starting over. They are included in the subscriptions covered above, so if you already pay for one, you already have a voice assistant.

The bigger shift is voice moving into the assistants you already use. On January 12, 2026, reporting confirmed an Apple deal for custom Gemini models to power a more personalized Siri later in the year, which would fold a frontier model into the assistant on hundreds of millions of phones.[218] Expect the line between "AI chat app" and "phone assistant" to keep blurring.

Two practical notes. Voice is best for input and thinking, less so for anything you need to read carefully afterward, so switch to text when you want to study the answer. And voice conversations are processed on the company's servers like any other input, so the privacy terms in 2.7 apply the same way.

Feature availability in this area changes fast, so confirm what your specific app and region support before you rely on a particular capability.

2.5 Deep research: Perplexity, Gemini, ChatGPT, Claude, Grok compared

Deep research is the mode where you ask one real question and the tool spends minutes, not seconds, reading many sources and writing a cited synthesis. It is the closest thing to handing a research assistant a brief. Five tools offer a version of it, and they differ in ways that matter.

Perplexity is the one built specifically for this. It leads with sources, attaches citations to almost every claim, and makes it easy to click through and verify. When your main worry is whether something is actually true, start here.

ChatGPT and Gemini both ship a deep-research mode inside their subscriptions. They tend to produce longer, more essay-like reports, and they are convenient because you are likely already paying for one. Gemini has an edge when your question touches Google's own data, like Maps or fresh web results.

Claude is strongest when the research is material you paste in yourself: a stack of documents, a long report, a set of transcripts. It reasons over what you provide better than it searches the live web.

Grok's distinguishing feature is real-time access to X, which makes it the choice for questions about breaking news or social reaction. It also posted the top score on one provider's legal-reasoning benchmark, 79.3% on Vals AI's Case Law v2, though that is the benchmark provider's own result, not an independent test.[203]

The honest caveat applies to all five. Every one can still cite a source that does not say what the tool claims it says. Deep research narrows the gap between AI confidence and reality, but it does not close it. Click the citations on anything that matters. The cross-check habit from 2.10 applies here too.

If you are building rather than chatting, the same research capability is now available as an API primitive: Gemini's URL Context tool and OpenAI's Responses API web_search tool let your own software ground answers on named pages or live search. The builder's view is in §5.9.[229]

2.6 Memory: what it is, why it matters, how to migrate it

Memory is the feature that lets an AI remember things about you between conversations, so you stop re-explaining yourself every time. It is genuinely useful and quietly risky, and most people never touch the settings.

ChatGPT introduced persistent memory on April 29, 2024.[11] It remembers facts you tell it and patterns it notices, then carries them into future chats. With the GPT-5.5 Instant update in May 2026, OpenAI added a way to see why the model remembered something, which makes the feature easier to trust.[46] Claude takes a different approach with Projects, where you load the relevant files and instructions into a workspace and everything in that project shares the context.[2] Gemini leans on memory sources and large file uploads, reading up to 1,500 pages of material you give it.[25]

Memory turns a generic tool into one that knows your writing style, your company's terminology, and your recurring tasks. The payoff compounds the more you use it.

The risk is the mirror image. Memory can be wrong, and it can be poisoned. A bad instruction saved to memory can quietly steer answers for weeks, and security researchers have shown that ChatGPT memory can be manipulated through ordinary-looking input.[52] Review your memory settings every so often and delete anything stale or odd.

On migrating memory between tools: no clean export-import button exists, and you should not wait for one. The practical method is to ask your current tool to summarize everything it knows about you and your preferences, then save that summary as a text file. Paste it into the new tool's memory or custom-instructions field. You own that file, it works across every model, and it doubles as a backup.

2.7 Privacy basics for non-paranoid people

The distinction that matters is account type: free and cheap consumer tiers may train on what you type, and paid business tiers generally do not. The settings differ by provider, so check yours. Anthropic, for example, updated its consumer terms on August 28, 2025: consumer Claude users now choose whether to allow their chats to be used for training, and the users who allow it have their data retained for up to five years, while those who decline keep the shorter 30-day window.[216]

Here is the rule that covers most people. Anything you would not want a stranger to read, do not paste into a free consumer chat. That includes client data, medical details, passwords, and unreleased work. For everyday questions, drafts, and learning, the consumer tiers are fine.

If you handle other people's confidential information, move up to a business tier with a no-training, low-retention agreement. OpenAI's ChatGPT Business and Enterprise plans commit to not training on your data by default. Zero data retention is a separate, request-only agreement rather than an automatic Enterprise feature, so ask for it explicitly if you need it.[21][20] Anthropic's Claude Team plan and Google's Gemini for Workspace offer comparable enterprise data controls.[167][168] The American Bar Association's Formal Opinion 512 tells lawyers to confirm exactly this before using any AI tool: check whether the provider trains on your inputs, and negotiate it away if needed.[83] That advice is sound for anyone with a duty of confidentiality, not just lawyers.

Two settings are worth finding on day one. First, the training opt-out toggle, usually under data controls, which on consumer tiers often lets you keep using the tool while declining to have your chats used for training. Second, memory, covered in 2.6, which decides what the tool retains about you across sessions.

If you are setting this up for a company rather than yourself, the same instinct scales into real controls: see §3.2 on connector permissions and §5.8 on the security surface of tools and MCPs.

The calm version of all this: match the tier to the sensitivity of the data. Casual questions on the cheap plan, confidential work on a business plan with a contract behind it. That single habit handles the large majority of real privacy risk.

One newer control is worth knowing about. OpenAI began rolling out a Lockdown Mode in ChatGPT on June 4, 2026, alongside Elevated Risk labels.[228] Lockdown Mode turns off the riskier surfaces, web browsing, image generation, Deep Research, Agent Mode, connectors, and downloads, to shrink the openings a prompt-injection attack can use. If you are handling sensitive material and do not need those features for a given session, it is the privacy-conscious default. The security mechanics behind it are in §5.8.

2.8 The meta-prompt trick (ask the AI to write your prompt)

Ask the AI to write the prompt, then run that prompt. This is one of the most underused moves in everyday AI use, though nobody has measured it against just asking. It works because the model has already read every prompt-engineering guide ever written. You haven't, and you shouldn't need to.

Here is the basic pattern: tell the AI what you are trying to accomplish and ask it to write a prompt you can give back to it, or to another AI, that will get you the best possible result. Then run that prompt. Practitioners sometimes call this "prompting the prompt."[287]

For consequential work, turn the trick into a prompt compiler. Ask the first model to interview you for missing facts, then write out one standalone prompt: what you want, what to work from, what is off the table, what the output should look like, how you will know it worked, and when to stop. Review that before you run it. Hand it to a fresh chat so it sees the finished instructions, not the back-and-forth that produced them. When a plausible mistake would be expensive, give the prompt and the finished work to a separate reviewer.

Nobody has published a study measuring whether the compiled prompt beats the direct request, and one early result cuts the other way for the newest models, which did better with a simple prompt than a heavily structured one.[310] I ran a small check of my own on a coding task: the compiler turned a vague request into instructions with five of the eight pieces I look for and surfaced seven questions I had not thought to answer, but it skipped the how-you-will-know-it-worked and when-to-stop pieces, and quietly added a step I did not want. The interview is where the value shows up. The review of what it writes is where you catch what it missed. Keep both.

A quick example. Say you want help with a lease dispute. You could type: "My landlord hasn't fixed my leaky faucet in three weeks. Help me write an email." That works fine. But try this first: "Write me a prompt I can give Claude to draft a polite but firm email to my landlord requesting urgent repair of a leaking faucet. The situation is: it's been three weeks, I notified him in writing on May 10th, and I want to preserve my options without burning the relationship." The AI will return a prompt that includes all the things a good prompt needs: tone guidance, relevant context slots, a request for a specific output length, and a framing that sets up the right register. Copy that prompt, fill in any remaining blanks, and run it.

A second example, for a company context: "Write me a prompt I can use to summarize a vendor contract and flag anything that could become a liability, written for a non-lawyer executive audience." The meta-prompt will prompt you to include the contract text, specify the audience, and ask the model to use plain language and flag concerns by risk level. That is a much better starting point than anything most people would draft from scratch.

Why does this work? Two reasons. First, the research on prompt structure is genuinely non-obvious: specific instruction placement, uncertainty protocols, output format specifications, and positive framing each shift quality measurably.[196] Most people writing prompts cold skip most of these. Second, the model can apply that knowledge to your specific situation in about two seconds.

When is this overkill? For simple, one-shot requests with no recurring use (ask it to explain a word, ask it to fix a typo), skip it. The meta-prompt pays off most when you will reuse a prompt, when the task has multiple interdependent requirements, or when you are building something that other people will use.

One practical note: the meta-prompt trick is especially good for building team prompt libraries. If your company is trying to standardize how it uses AI for a category of work (vendor summaries, client intake forms, status updates), running the meta-prompt and then iterating on the result is a fast way to get to a reusable template that actually works.

2.9 When the AI gets stuck: failure handling

Most people encounter AI failures and assume the tool just doesn't work for their use case. Usually, the problem is fixable in under a minute.

Refusal and safety blocks

When the model refuses a request, the first question to ask is whether the refusal is a genuine safety concern or a precision problem. Almost always, it is a precision problem. The model refused because your request was ambiguous, or it defaulted to a cautious interpretation.

The fix: add context and reframe positively. "Don't write anything that could be seen as threatening" becomes "Write this in a professional, measured tone that focuses on legal remedies." Specifying who you are and why you need something also helps: "I'm a nurse asking about medication dosages for patient education purposes" gives the model context to interpret the request correctly.

If you are genuinely hitting a policy block (adult content, certain weapons information, etc.), no amount of prompt rewriting will change that. Switch tools or rethink the task.

A related issue: Anthropic's prompt engineering guidance notes that Claude in particular can backfire on negative instructions.[197] Telling the model "don't make things up" may actually increase fabrication by making the unwanted behavior more salient. Say what you want instead: "Only state facts you are confident about. Use phrases like 'I'm not certain, but...' when you're unsure."

The hallucination spiral

Sometimes a conversation goes sideways and the model starts generating content that is increasingly wrong or increasingly confident about things it shouldn't be confident about. This is a context problem. The model has accumulated a conversation history that is steering it toward a bad pattern, and each new response builds on that accumulated wrong foundation.

The fix is to start a fresh conversation, not to argue with the current one. Paste in your original request with any clarifications you have developed from the failed conversation, and go again. Continuing to push in a broken conversation is the single most common way people waste AI time.

For longer tasks, this means building a habit of occasionally checking factual claims against fresh sources before the conversation goes too far in the wrong direction.

Tool and browsing failures

When a model with web browsing returns nothing useful, or returns a summary of a page that doesn't match what you know, the web tool probably fetched a paywalled version, a redirect, or a cached empty result. Options: paste the relevant text directly into your conversation, switch to a model with better web access (Perplexity is purpose-built for this, and is good at attribution), or just ask the model to tell you what it knows from training data and flag what needs verification.

Switching models

Different models have real, consistent differences for specific task types.

If you are doing research with real-time sources: Perplexity or Gemini 3.5 Flash with grounding are better than Claude or ChatGPT without web access. If you are doing multi-step reasoning over a document you have pasted in: the current frontier models (Claude Opus 4.8, GPT-5.5) are strong. If you are writing code: Claude and ChatGPT both handle this well, but they have different strengths across language and framework combinations. If the task is highly time-sensitive and needs current data: any model without live web access will struggle.

Switching is not a sign of failure. Running the same prompt across two models and comparing the results is a legitimate quality check.

2.10 Hallucination mitigation for everyday users

AI makes things up. This is not a bug that will be fixed in the next release. It is a structural feature of how these models work, and any practical guide to using AI has to spend time on it.

What hallucination is and why it happens

A language model generates text by predicting what comes next, token by token, based on patterns in training data. It is not retrieving facts from a database. It is not checking its claims against a source. When it generates a plausible- sounding citation, name, statistic, or URL, it is doing pattern-matching, not recall. The result looks authoritative and reads fluently, even when it is completely wrong.

Research shows that models have meaningful but imperfect self-knowledge: they can partly distinguish questions they can answer correctly from questions they cannot, though calibration is far from reliable.[188] The rest of the time they genuinely cannot tell, and they fill the gap with something plausible.

The high-risk task categories

Some categories of AI output carry much higher hallucination risk than others. Apply extra scrutiny to:

• Academic citations. Studies show a large share of AI-generated citations are fabricated when no source material is provided, with measured rates ranging from roughly a third to the large majority depending on the model and task.[198][199] The paper title, author names, journal, and DOI may all be plausible-looking inventions.
• Specific statistics. A number like "73% of companies report X" is exactly the kind of output that looks verified and isn't.
• Dates and timelines. The model's training data has a cutoff, and events near that cutoff are underrepresented. It can confidently state a date that is wrong by months or years.
• Recent events. Anything that happened in the last several months relative to the model's training cutoff is either absent or sparsely represented.
• Legal cases, statutes, and regulatory citations. The Mata v. Avianca incident, No. 22-cv-1461 (S.D.N.Y. June 22, 2023), is the canonical cautionary example: lawyers submitted AI-generated briefs citing cases that did not exist, and the court sanctioned counsel. This class of failure has replicated across many subsequent cases, covered in detail in Part 4.7.
• Medical and pharmacological specifics. Dosages, drug interactions, and diagnostic criteria are exactly the kind of dense factual territory where the model sounds authoritative and can be wrong in ways that matter.

The cheap mitigations that actually work

You do not need to become a prompt engineer to reduce your hallucination exposure. These four habits cover most of the practical risk.

Ask for confidence levels. Adding "Tell me what you're confident about and what you're uncertain about" to any factual request shifts the model's behavior meaningfully. Research suggests the instruction works best with graduated language rather than a binary "say I don't know" command.[188] "I'm confident that... / I believe but am not certain that... / I don't have sufficient information" is more accurate than a flat flag.

Ask for sources, then verify them. "Cite the source for each claim" is worth adding to any prompt where you care about accuracy. Two caveats: if you paste in documents, asking for inline citations to those documents cuts hallucination substantially by grounding answers in text the model can point to.[200] If you don't provide documents and ask for citations anyway, the model may fabricate them. So the rule is: provide your sources, then ask the model to cite them. Don't ask the model to find sources it then has to invent.

Cross-check across two or more models. If you get a specific claim from one AI and it matters, run the same question through a second one. Agreement does not guarantee accuracy (both models may share training data or the same blind spot), but disagreement is a reliable flag that something needs human verification. For high-stakes work, do not merely ask "which answer is better?" Put the answers side by side and ask a third pass to extract consensus, contradictions, missing coverage, and unique insights. That is the practical version of the emerging multi-model fanout pattern: several models generate, then a judge or human reviewer compares.[206]

Use grounded research tools for factual claims. Perplexity and Gemini with web grounding are built to attach citations to live sources. For any claim that needs to be current and verifiable, these are better choices than a closed-context chat model. They hallucinate too, but less on current factual questions, and they show their sources.

What not to trust AI for without verification

The short list: specific legal citations, specific academic citations, specific statistics not drawn from a document you provided, any claim about recent events, and any domain where being wrong has real consequences for someone's health, legal situation, or money. AI is genuinely good at synthesizing, explaining, drafting, and reasoning. It is not a substitute for a verified primary source on specific facts.

The practical rule: if you would cite it to a client, a court, a doctor, or your boss, verify it.

2.11 Other high-value everyday techniques

These are techniques the research literature consistently supports but that most everyday AI users don't know about. Each one is low-effort and produces real improvements.

Use the universal prompt contract

For any task that matters, a good prompt is a small contract. It says what you want, what context matters, what good looks like, what evidence the model may use, what format you want back, and how the model should handle uncertainty. That is the durable pattern behind most prompt advice in this guide.

The everyday version is:

Help me [goal]. Context: [facts]. Audience: [who will read/use this]. Tone: [tone]. Format: [desired shape]. If anything is uncertain, say so instead of guessing.

If a prompt fails, do not immediately reach for a more elaborate trick. First ask which part of that contract is missing. Most bad outputs are missing audience, success criteria, evidence rules, or output shape.

Show examples of what you want (few-shot prompting)

The fastest way to get AI output in exactly the format and register you want is to show it one or two examples. This is called few-shot prompting in the research, and it is one of the best-supported techniques across all of the prompt engineering literature.[189]

Concretely: if you want a weekly status update in a specific format, paste in one or two previous updates you liked and say "write this week's update in the same format and tone." If you want a contract clause in a specific house style, paste in a clause from an existing contract as the example. The model uses the example primarily to lock in format and register, which is usually what you were actually struggling to specify in words.

Three good examples are better than ten mediocre ones. And the last example you provide has the most influence on the output, so put your best, most representative example at the end. One study found that example ordering alone could swing accuracy from near state-of-the-art to near random.[190]

Specify the output format

Tell the model exactly what you want back. "Give me this as a table with three columns: risk, likelihood, and mitigation." "Give me bullet points, no more than six, each under 15 words." "Return this as a JSON object with the fields name, date, and action_required."

Format specification is one of the core techniques the research identifies as explaining much of the variance in prompt quality.[196] Most people never use it and then wonder why the output is in the wrong shape. Adding one sentence of format instruction to your prompt costs nothing.

If you use Claude specifically: XML tags around sections of a complex prompt (like <context>, <examples>, <instructions>) help the model parse your input and produce structured output. Claude was trained to recognize this structure.[197] For ChatGPT, markdown headers work similarly.

Ask the model to grade its own output and rewrite it

After you get a first draft, add: "Now critique that response. What's weak, incomplete, or potentially wrong? Then rewrite it to fix those issues."

This two-step generate-then-refine loop produces measurably better outputs. One study found roughly a 20% average improvement across a range of tasks.[191] For code, the gains are especially large. Two caveats: limit this to one or two refinement passes (returns diminish sharply after that), and for pure factual recall, this technique can actually make things worse if the model "corrects" a right answer to a wrong one.[192] Use it for drafts, analysis, and code. Be more cautious with it for factual questions.

Put the important stuff at the start and end

Research from Stanford and UC Berkeley (Liu et al. 2023) found that AI models attend most to information at the beginning and end of a prompt, with roughly a 20 percentage-point accuracy drop for information buried in the middle.[102] This matters practically: if you have a long prompt with background context in the middle and your actual question at the end, the model may give your question less weight than the framing material.

The fix: state your main request at the top, put background context in the middle, and restate the core ask at the bottom. For long documents you are asking the model to analyze, the same logic applies: the most important passages are better placed near the start or end of your pasted text.

The recency-of-example effect

Related to the point above: when you give the model multiple examples, the last one carries disproportionate weight in shaping the output. This is the recency bias documented in Lu et al. 2022.[190] If you want the model to write in a particular style, or to follow a particular template, put your best and most representative example last.

On "you are an expert in X"

Role prompting is everywhere in AI advice. "You are a world-class copywriter." "You are an expert in tax law." The research consensus on frontier models is that generic expert labels have minimal effect on accuracy.[193] They reliably change tone, and they can introduce overconfidence without improving the underlying reasoning. The effect is domain-specific rather than uniformly absent: impersonating a relevant expert can shift results on narrow tasks.[194]

What works better: embed the methodology you actually want into the instruction. Instead of "You are an expert negotiator," try "Before suggesting a negotiating position, identify the other party's likely priorities and constraints, then suggest a position that acknowledges those while advancing my goals." You are describing a process, not a credential. When role prompting does help, the research finds the gain comes from activating a specific reasoning process, not from the credential itself.[195]

2.12 Graduating from chat to an agent

Most people stop at the chat box, and for a lot of work that is the right place to stop. But there is a ladder above it, and you do not have to be an engineer to climb the first few rungs. Each rung gives you something the one below it cannot, and each has a clear signal that you have outgrown it. Move up only when the signal shows up, not because the next rung sounds impressive.

Rung one is plain chat. It drafts, summarizes, and answers, and for occasional work that is enough. You have outgrown it the moment you notice you are pasting the same background or re-running the same task by hand every time.

Rung two is the same chat app with memory, projects, and connectors switched on, which §2.6 and §3.1 through §3.2 cover. Now the tool knows your writing, your terminology, and your files, and it can reach the accounts you connect. You have outgrown it when you want a job to run start to finish without you steering each step.

Rung three is a consumer agent surface. Claude Cowork is Anthropic's desktop agent that works across your files and documents, and ChatGPT's workspace agents play a similar role inside OpenAI's apps.[217] These run multi-step work, use the apps you connect, and pause to ask before they do anything consequential, and they do it without a line of code. You have outgrown this rung when the agent cannot reach a system you depend on, or when you need direct control over files and automation that a consumer surface will not give you.

Rung four is a coding agent. Claude Code and Codex run on your machine, read and write real files, and automate multi-step work, and the important thing for a non-technical reader is that you do not have to be an engineer to use them for file and automation tasks. You can point Claude Code at a folder of documents and ask it to rename, reorganize, or extract from them in plain English. The fastest way to learn the tool is to use it on itself: make a project called "Learning How to Use Claude Code," drop this guide into its project files, and ask the tool to build you a curriculum to become proficient.[235] §2.13 covers that move in full. The moment you are wiring a model into other systems or building something repeatable, you have crossed into building. Read §3.6 for the line between staying in the chat UI and bringing in a developer, then Part 5 for the builder track itself.

The ladder is not a race. Plenty of people get everything they need from rungs one and two, and that is a sound place to settle. Climb only when the work in front of you asks for it.

2.13 Learning the tool by using it

The fastest way to get good at a coding agent is to spend real usage learning it, not to read about it first. The move has four parts, and you can run all of them in an afternoon.

First, understand how your plan meters usage. Anthropic's paid plans measure use in a rolling five-hour session window, with separate weekly limits on top, and Claude Code draws from the same pool as the chat app.[234] The practical consequence is that you should treat a session as a budget to spend deliberately: run real tasks, watch where the usage goes, and you will quickly learn which kinds of work are cheap and which are expensive. Spending a window on purpose teaches you more about the tool's economics than any pricing page.

Second, make a dedicated learning project. Create a project called "Learning How to Use Claude Code," and put reference material into its project files so every session starts with context. Dropping this guide in is a reasonable starting point, because it gives the tool a shared vocabulary with you.

Third, meta-prompt your own curriculum. Ask the tool to build you a curriculum to become proficient, then work through it with the tool itself as the tutor. This is the meta-prompt trick from §2.8 pointed at your own learning: the model has read more documentation than you have time to, so let it sequence the lessons.

Fourth, read the official learning path. Anthropic maintains a learning hub at anthropic.com/learn that links its Academy courses for both users and builders.[235] Use it to fill the gaps your hands-on sessions expose.

The throughline: burn a window on real work, keep the context in a project, let the tool teach you, and check your understanding against the official path. That loop turns a week of poking into genuine fluency.

2.14 Health, money, and travel: the three places to slow down

The tools got dramatically better at your highest-stakes personal paperwork in 2026, and the evidence that they are safe to trust with it did not keep up. This section exists because the gap between those two sentences is where people get hurt.

Health. OpenAI launched ChatGPT Health in January 2026 and expanded it on July 23, 2026 to US users aged 18 or older on web and iOS, subject to rollout and product limits.[265] It can connect a hospital patient portal or Apple Health and answer plain-language questions about labs and visit notes. That is genuinely useful, and it is the single best use I know for these tools in a medical context: turning a discharge summary into English, building a question list before an appointment, and keeping a medication list straight.

Two cautions, both serious. In most consumer-app use, HIPAA protection does not follow records after they leave a covered provider. The result can differ when the app acts for a covered entity or business associate, so check the actual relationship and terms.[265] A coalition of state attorneys general also subpoenaed OpenAI in mid-2026 over its health-data handling.[265] And in July 2026 a Florida man sued OpenAI alleging that ChatGPT told him he had dysautonomia based on uploaded labs and imaging and advised him to stay recliner-bound, after which he suffered a pulmonary embolism that a physician attributed to the prolonged immobility.[266] The allegations are unproven, and I raise the case for the pattern rather than the verdict. The pattern is that a model will answer a diagnostic question confidently and will not tell you it should not have. Use these tools to prepare for a doctor and to understand what a doctor already told you. Do not use them to decide whether to see one.

Money. A 2026 test ran eight fictional tax scenarios through ChatGPT, Gemini, Claude, and Grok with the required forms supplied. Across the four chatbots and eight scenarios, the reported average absolute calculation error exceeded $2,000, and every model made at least one error.[267] Every needed input, still wrong. Tax preparation is exactly the kind of task these tools look competent at and are not: it rewards arithmetic precision and current statutory knowledge, and they are weak at both. Use AI to understand what a form is asking. Do not let it compute what you owe. And think twice before feeding a Social Security number and a full income picture into a chat window at all.

Travel and anything that spends money. Booking agents crossed from answering to acting in 2026. Google's Gemini Agent and Chrome's automatic browsing can compare and book across sites, and Delta's Concierge can cancel and rebook a disrupted itinerary on its own.[268] The failure mode changed with the capability: a wrong answer costs you nothing, and a wrong booking is a charge. One documented Delta case had the assistant tell a passenger her flight was safe, then cancel it and quote double to rebook.[268] Consumers have priced this in already. A June 2026 survey found 60% of UK consumers would abandon an AI shopping agent after a single mistake, and only 19% trust one to make everyday purchases correctly.[268] Let an agent assemble the options. Press the button yourself.

One thing to do this week, for your family. Voice cloning has made the grandparent scam cheap and convincing, and scammers now clone a relative's voice from a few seconds of social media audio to stage a fake emergency.[269] The countermeasure costs nothing: agree on a family safe word, and verify any urgent request for money by hanging up and calling back on a number you already have. Never the number that called you.

Part 3: The regular company track

This part is for the operator at a normal company. Not a tech firm, not a law firm, just a business with a CRM, an inbox, a calendar, and not enough hours. The goal here is return on a modest investment, proven fast, before you spend big.

3.1 The email, calendar, and CRM play

The highest-return move for most companies is connecting one AI assistant to the three systems where work actually happens: email, calendar, and CRM. Do that, and the assistant stops being a clever toy in a separate tab and starts handling the glue work that eats the week. This is a capability worth proposing to almost any team that sells, supports, or coordinates with people outside the building.

Pick the assistant that already lives where your data is. If the company runs on Google Workspace, Gemini connects natively to Gmail, Calendar, and Sheets, and Claude and ChatGPT both reach the same tools through their own Google connectors. If it runs on Microsoft 365, Copilot reaches Outlook, Teams, and Excel without extra wiring. The CRM connects on top: Salesforce and HubSpot both expose connectors the major assistants can read and write. The rule is to follow the stack you already have rather than adopt a new one for the assistant's sake.

The play, in order. First, connect the assistant to the inbox and calendar so it can draft replies, summarize long threads, and prep people before meetings. Second, connect it to the CRM so it can log activity, draft follow-ups tied to a specific deal, and surface which accounts have gone quiet. Third, set a standing instruction so the assistant runs a morning pass: what needs a reply today, which meetings need prep, which deals are stale.

Three workflows show the range.

The outreach tracker. Keep a single spreadsheet as the source of truth for every prospect: name, company, last touch, next step, status. Then let the assistant orchestrate it. New replies in the inbox get logged to the right row, the assistant drafts the next message in the sequence, and a daily pass flags who has gone cold and who is due for follow-up. One person can run outreach to dozens of clients this way without a heavyweight CRM, because the spreadsheet is the CRM and the agent is the operator.

The meeting-to-record handoff. A meeting ends, and the notes become a CRM update and a follow-up email without anyone retyping. The next time that account emails, the reply draft is waiting with the deal history already pulled in. This is the handoff that removes the most invisible work.

The morning triage. A standing instruction runs before the day starts: summarize overnight email, list what needs a reply, name the meetings that need prep, and flag stale deals. The person opens one digest instead of three apps.

Two stacks, gone deep. Google-native is Gemini for Workspace, or Claude or ChatGPT with their Google connectors, wired to Gmail, Google Calendar, and a Google Sheet as the tracker, with HubSpot added as the CRM once you outgrow the sheet. Glue the steps with the assistant's own scheduling, or add Zapier or Make for triggers the assistant cannot fire on its own. Microsoft-native is Microsoft 365 Copilot wired to Outlook, Teams, and Excel, with Dynamics or Salesforce as the CRM. Copilot's advantage is that it already sits inside the tools, so the connector work is minimal. The tradeoff is that it is strongest only when the whole company is on Microsoft.

Start with email and calendar alone for the first two weeks. They deliver value immediately and carry less risk than wiring an assistant into customer records. Add the CRM, or the spreadsheet tracker, once the inbox habit sticks.

3.2 Connectors, MCPs, plugins: explained without jargon

A connector is the bridge that lets your AI assistant read from and write to another app, like Slack, Notion, Salesforce, or Google Drive. That is the whole idea. The jargon around it (MCP, plugins, integrations) describes how the bridge is built, not what it does for you.

The term you will hear most is MCP, the Model Context Protocol. Anthropic published it as an open standard in late 2024, and it has become the common way for AI tools to talk to other software.[182] Think of it as a universal plug. Before MCP, every AI-to-app connection was custom. Now any compliant assistant can use any compliant connector, the way any USB-C cable fits any USB-C port.

The ecosystem exploded. Researchers cataloged 67,057 MCP server listings across six public registries using data collected in June and July 2025.[100] That is a listing count from a defined historical sample, not a count of live servers in 2026. The breadth is the appeal and the catch. You can connect almost anything, but not everything is safe to connect.

The security part is not optional, so here it is plainly. A connector is executable code that you are granting access to your data and, often, the ability to act on your behalf. The registry study found hundreds of vulnerable listings. Separate April 2026 research estimated that an affected MCP supply-chain pattern reached more than 7,000 public deployments, but code execution depended on downstream software accepting attacker-controlled STDIO configuration. The research did not establish that 7,000 hosts were successfully exploited.[100][137] The NSA published guidance on MCP security in May 2026, which tells you the stakes are no longer hypothetical.[111]

Four rules keep you safe without a security team. Install connectors only from sources you trust. Give each one the least access it needs to do its job. Require an approval step before any connector can create, change, delete, or pay for something. And pin to specific versions rather than auto-updating, so a compromised update cannot walk straight into your systems.[111]

3.3 Where to start: cheap pilots that prove ROI

Start narrow, on a high-volume task one team does every day, and measure before you scale. The data on AI pilots is sobering, and ignoring it is how companies waste money.

The sobering number first. A preliminary 2025 MIT NANDA report said 95% of the enterprise generative-AI initiatives it examined showed no rapid, measurable profit-and-loss impact.[106] The report drew on interviews, conference survey responses, and public initiatives rather than a representative audit of all enterprise pilots. Treat 95% as a directional finding from that sample, not a population failure rate. The initiatives that performed better targeted a specific, repetitive workflow rather than chasing a vague "adopt AI" mandate. The report also associated focused external tools with better outcomes than internal builds, but the evidence does not support a universal buy-over-build rule.[106]

So what does work? The evidence points to narrow, high-frequency tasks where time savings are easy to count. Anthropic's deployment with HUB International put Claude in front of 20,000 employees and, in vendor-published figures with no independent measurement, saved about 2.5 hours per employee per week on the targeted use cases.[160] A controlled study run with Boston Consulting Group consultants found that on tasks that suited the model, those using it completed 12.2% more tasks, did them 25.1% faster, and produced work rated over 40% higher in quality, while on tasks outside the model's strengths they did notably worse.[104] That last finding is the warning: match the pilot to what AI is actually good at.

Overreach is the other failure mode, and Klarna is the cautionary tale. The company replaced much of its customer support with AI, then publicly walked it back when the CEO conceded the work had come out at lower quality, and it began rehiring human agents.[54] The lesson is not that AI cannot do support. It is that scaling past what the model reliably handles, with no human backstop, costs more than the headcount it was meant to save.

Pick a pilot that meets four tests. The task is repetitive, it is done often, the output is easy to judge, and a human stays in the loop. Drafting first-pass email replies, summarizing long documents, turning meeting notes into structured records, answering routine internal questions. These are the proven starting points because they hit all four tests.

Two traps to avoid. The first is the productivity illusion: a METR study found experienced developers were actually 19% slower with early-2025 AI on mature codebases, yet believed they had been faster.[98] METR's 2026 follow-up then measured the same developers faster with newer tools, with intervals wide enough to include zero, and called its new data an unreliable signal of the current effect.[99] The trap survives either sign: measure real output, not the feeling of speed. The second is dead seats: a large share of paid Copilot licenses go unused within the first few months. Adoption below roughly a third of the team kills the return, so a small pilot with real usage beats a wide rollout nobody opens.

Once a pilot proves out, the next step is making the winning workflow run on a schedule instead of by hand. OpenAI's workspace agents, launched May 6, 2026 on Business, Enterprise, and Edu plans, are shared agents that run on a schedule, pause for an approval gate before acting, and report usage through an Agent Analytics view.[226] That combination, scheduled runs plus an approval gate plus analytics, is exactly the shape a repeatable workflow wants: deterministic, supervised, and measurable. Reach for it when a pilot has earned a permanent place, not before.

3.4 Building shared team context (project files, shared memory)

The difference between a team that gets real value from AI and one that does not is shared context. When every person re-explains the company from scratch in every chat, the tool stays generic. When the context lives in one place the whole team draws from, the answers get specific and they compound.

The cleanest pattern comes from Andrej Karpathy, who in early 2026 popularized treating an AI knowledge base like a wiki the model maintains.[55] You keep raw source material in one folder, the AI builds structured notes alongside it, and a plain instruction file tells the model how your organization works. Traditional document search forgets everything between sessions. A maintained knowledge base remembers, so each use adds to it instead of starting over.[127]

For a normal company, this looks like three things. A shared folder of source documents: policies, product specs, past proposals, the answers to questions people keep asking. A set of structured notes the AI helps keep current. And a short context file, the kind Anthropic calls a system prompt at the right altitude, that states who you are, how you talk to customers, and what good output looks like.[115]

3.4.1 The company context layer

For chat products, use Projects or their equivalent for recurring work. Put the stable files there once, then start fresh chats inside the project. Do not keep dropping the same files into unrelated chat windows. That creates version confusion and trains the team to use chat history as a filing cabinet. The better pattern is: stable context in project files, temporary reasoning in the chat, and a short handoff prompt whenever a new window takes over.

Assign owners to these files. Review them on a cadence. Archive stale drafts instead of leaving contradictions in place. The simplest rule is the best one: if three people have pasted the same explanation into AI, it belongs in shared context.

The team prompt library is the other half. When someone works out a prompt that reliably produces a good vendor summary or a clean status update, it goes in the shared library so nobody reinvents it. The meta-prompt trick from 2.8 is the fast way to build these: have the AI draft the reusable prompt, then refine it once with the team.

3.4.2 Prompt and skill libraries as operating infrastructure

Keep it boring and central. One folder, one context file, one prompt library, all in a place everyone can reach. Practitioner playbooks from the 2026 scrape converge on the same lesson: the instruction file should be short, explicit about conflicts, honest about token budgets, and paired with persistent notes rather than an ever-growing chat transcript.[208][209][213] The technology matters less than the habit of putting shared knowledge somewhere shared.

For teams, call this promptware rather than prompts. A reusable AI workflow should store the prompt, owner, model, required inputs, output format or schema, examples, known failure modes, review checklist, last-tested date, and version. That sounds heavier than "save this prompt in a doc," but it is the difference between a personal trick and operating infrastructure.

Skills are the next rung up from promptware. Anthropic's official guidance treats a skill as a discoverable bundle of instructions, scripts, and resources that Claude can load when the task calls for it.[237] That is the right mental model for a company: keep the active library small, name the owner, write a specific description, test it on real work, and retire stale skills. A 20-skill library that fires reliably beats a 200-skill drawer nobody trusts.

Do not dump the whole company brain into a skill. Use the skill for the procedure, and point it to the knowledge files it needs. A sales-call briefing skill might point to the CRM rules, customer-notes folder, approved tone guide, and output template. The skill says how to work. The knowledge files say what is true. One caveat from §5.5: the small slice of knowledge the assistant needs on every task belongs in the always-loaded project file itself, not behind a pointer it has to choose to follow, because measured evals show agents often never decide to look.

Give the library a promotion rhythm. If the team repeats the same workflow three times, write it down as a candidate skill. If the skill log has ten new patterns, review the cluster and decide what deserves to become shared infrastructure. Most skills should die as notes, not graduate. The point is not to collect skills. The point is to turn repeated work into a small set of reliable procedures.

For research-heavy work, separate raw source from synthesis. A useful structure is raw/ for untouched captures, notes/ for summaries, claims.md for important claims, contradictions.md for sources that disagree, open-questions.md for unresolved work, and synthesis.md for the current best answer. Never let the synthesis become the source.

3.5 Cost discipline: the per-seat math

Two pricing models exist, and confusing them is the most common budgeting mistake. Per-seat means a flat monthly fee per person. Per-use means you pay by the token for what you actually run through the API. Chat subscriptions are per-seat. Building on the API is per-use.

The per-seat field, as of August 31, 2026:

The per-seat math is simple. Multiply the seat price by the number of people who will genuinely use it, not the headcount you hope will. A large share of paid seats go unused within the first few months, so the realistic cost is the seat price divided by your true adoption rate. A $30 seat at 50% adoption costs $60 per actual user.

Per-use pricing matters once you build, and it fell hard over the summer. The frontier APIs as of August 31, 2026: Claude Opus 5 at $5 per million input tokens and $25 output, GPT-5.6 Sol at $4 and $20, GPT-5.6 Terra at $2 and $12, Claude Sonnet 5 at $2 and $10, and Gemini 3.7 Flash at $0.75 and $3.75 on introductory pricing that rises January 1, 2027.[240][241][242] Two of those are temporary. OpenAI cut Terra and Luna permanently on July 30, 2026, but Sol's $4 and $20 is promotional at least through November 21, 2026, and Gemini's rate doubles on January 1, 2027.[241][242] OpenAI has not announced Sol's later price. Test a conservative scenario in your budget, but label it as your assumption rather than vendor pricing. For a high-volume automated workflow, per-use can be far cheaper than buying everyone a seat. For interactive daily work, per-seat is simpler and usually wins.

One planning note that follows from the price cuts. If you built a cost model before July 2026 and rejected an automation as too expensive, re-run the arithmetic. A workflow that cost $30 per million output tokens on the old flagship now costs $12 on a mid-tier model that did not exist in June.

The discipline that saves the most money is not picking the cheapest tool. It is killing dead seats and matching the pricing model to the workload.

3.6 When to involve a developer vs stay in the chat UI

Stay in the chat app as long as a person is in the loop on every task. Bring in a developer the moment you want the work to run unattended, at volume, or wired into your own systems. That single line decides most cases.

The chat UI is the right tool for an enormous amount of work: drafting, summarizing, research, analysis, answering questions, one-off automations through built-in connectors. If a human is prompting and reviewing each result, you do not need to build anything. Most companies never need to cross this line, and crossing it early is a common way to overspend.

Four signals say it is time to build. You want a workflow to run on a schedule with nobody watching, like processing every overnight order. You need it to act across many records at once, not one at a time. You want it integrated with an internal database or a SaaS tool through a connector you control. Or the volume is high enough that per-use API pricing beats paying for seats.

There is now a middle tier between "stay in the chat" and "hire a developer," and it is worth knowing before you commission custom software. OpenAI's workspace agents let you stand up scheduled, approval-gated automations inside ChatGPT without writing application code,[226] and the May 2026 release notes add the operational details a company should care about: app-specific action safeguards, admin visibility, Codex goal mode, browser improvements, and usage analytics.[238] Its Apps SDK, previewed November 13, 2025, lets developers build interactive apps that run inside ChatGPT itself.[227] The Codex app pushes the same idea on the building side: a desktop surface for supervising several coding agents at once rather than one terminal session.[225] The practical read: try the no-code or low-code middle tier before you pay for a from-scratch build, and only cross into custom software when the middle tier genuinely cannot reach your systems.

The capability is real now, which is why the line matters. OpenAI's Codex added a persistent goal command in April 2026 that lets an agent keep working toward an objective across many steps, and Anthropic's Claude Opus 4.8 can plan a job and run hundreds of parallel sub-agents to do things like migrate a codebase of 100,000 lines.[60][1] This is genuinely useful and genuinely able to burn money. One team running parallel coding agents reported spending $7,000 in a single day.[138]

So the developer's first job is not writing code. It is putting guardrails on the autonomy: budget limits, approval gates, and a clear stop condition. Bring them in when you cross the line, and have them build the brakes before the engine.

3.7 Vendor selection (the short list per use case)

No single vendor wins everything, so pick by the job in front of you. The honest summary of 2026 is that the models specialize, and your existing software stack should break most ties.[133]

By use case:

• General assistant and knowledge work: ChatGPT or Claude. ChatGPT for broad versatility, Claude for writing and reasoning over long documents.[133]
• Coding and software work: Claude with Claude Code for cross-file autonomy, Cursor for an editor-based workflow, OpenAI Codex for its goal loop.[1][138]
• Research and current events: Perplexity for citation-backed answers, Grok for live data from X.[47]
• Image generation: Google's Nano Banana for a strong first image, ChatGPT for iterative edits.[26]
• Multimodal input (video, audio, PDFs together): Gemini 3.5 Flash.[224]

By existing stack, which is the tiebreaker that matters most:

• Microsoft shops: Microsoft 365 Copilot at $18 to $30 a seat, plus GitHub Copilot for developers. It is already inside Office and GitHub, so adoption friction is lowest.[164][166]
• Google Workspace shops: Gemini, built into Gmail, Docs, and Sheets, from about $20 a seat.[27][168]

The rule that prevents most buyer's remorse: weight the vendor that integrates with the tools your team already opens every day. A slightly weaker model your people actually use beats a slightly stronger one they have to switch tabs to reach.

3.8 Evaluation harnesses and reproducible AI work

The next maturity step after "people are using AI" is "we can tell whether it is getting better." That requires a small evaluation harness: representative tasks, expected outputs or rubrics, model and prompt versions, the documents supplied, cost, latency, and reviewer notes. Without that, every vendor demo and every prompt tweak is judged by vibes.

Open-source diagnostics like iFixAi are useful less because any one score is definitive and more because they model the right shape of evidence: repeatable runs, scorecards, cross-provider judging, and content-addressed manifests.[210] For a company, start smaller. Save ten real examples, strip secrets, write down what good looks like, and rerun the same set whenever you change models, prompts, tools, or retrieval. If the new setup is faster but misses one of the ten things that matters, you learned something before it reached customers.

Rerun the eval set after five events: a model upgrade, a prompt edit, a tool change, a retrieval or context change, or a new high-stakes use case. Record the model, prompt version, tool permissions, context source, reviewer, cost, latency, and rollback rule. For legal or compliance workflows, add fixtures for citation accuracy, privilege/confidentiality handling, matter access, and approval logs.

3.9 From prompts to workflow design

Prompt engineering is no longer just clever wording. In 2026 the durable gains come from workflow design: what context gets loaded, what model handles which step, which tools are allowed, where the output lands, who reviews it, and how the result is stored for next time.

This is why prompt libraries should not only store text. They should store the whole pattern: source inputs, model choice, expected artifact, review checklist, and failure modes. A good "prompt" for vendor review or board prep is really a small operating procedure. The words matter, but the surrounding workflow matters more.

Here is what that looks like in practice. Take a recurring task most companies have: turning a sales call into a follow-up. The prompt-only version is "summarize this transcript and draft a follow-up email." The workflow version names every moving part. The input is the call transcript pulled from your meeting tool. A cheap model does the first pass: extract the attendees, the commitments made, and the open questions. A stronger model drafts the follow-up email in your house style, loaded from a project file. The output lands as a draft in your CRM, not in a chat window you will lose. A human approves it before it sends, and the approved version is saved back to the prompt library as the new template. The wording of the summarization step barely changes month to month. The decisions around it, which model, which context, where the result goes, and who signs off, are the part worth designing once and reusing. Section 3.8's eval harness is how you check that the workflow still produces the result you want after a model or prompt changes.

3.10 What actually goes wrong

Most of Part 3 tells you what to do. This section tells you what the evidence says happens instead, because a plan built only on vendor case studies is a plan built on a filtered sample.

Most projects do not deliver. Gartner surveyed 782 infrastructure and operations leaders in late 2025 about AI projects in their own infrastructure and operations function. In that sample, 28% delivered the promised return, 20% failed outright, and 57% of organizations reported at least one AI failure. The two leading causes were skill gaps and poor data quality, tied at 38%.[270] Those results do not describe every enterprise AI project. Read the two causes carefully, because they are worse at small-company scale, not better. In July 2026 BCG reported that nearly nine in ten CEOs saw some benefit in targeted areas while most were unable to scale it across the enterprise.[271] The pilot working is not the hard part. Getting past the pilot is.

Seats go unused, and the waste is larger than the sticker price. Industry tracking in 2026 puts weekly active use of paid Microsoft Copilot seats at roughly 20% to 30%.[272] Section 3.5's arithmetic applies directly: at 25% adoption, an $18 seat costs $72 per person actually using it. Buy in small batches, measure weekly active use, and reclaim what nobody touches.

Replacing people with AI has an unusually high regret rate. Reporting on Forrester's 2026 predictions said 55% of employers that cut headcount citing AI would later regret it.[273] Separate rehiring and restaffing-cost figures have been attributed to a different survey, but I could not obtain its primary report, so I have omitted them. The clearest named example is Commonwealth Bank of Australia, which cut 45 call-center roles on the claim that a voice bot had reduced call volume by 2,000 per week. Call volumes then rose, the bank apologized for the error, and it moved to rehire.[274] The lesson is not that automation never works. It is that the self-reported metric justifying the cut is often the thing that is wrong.

Agents connected to your systems are a security exposure, not just a productivity tool. A January 2026 online survey of 418 IT and security professionals reported that 65% had experienced at least one AI-agent-related incident during the prior year, with 61% reporting data exposure. Token Security financed the survey and co-developed its questionnaire with the Cloud Security Alliance, so treat it as vendor-commissioned evidence rather than a neutral incident census.[275]

The concrete case worth understanding is CVE-2025-32711, or EchoLeak. Security researchers demonstrated a zero-click attack path in Microsoft 365 Copilot: a later user query caused Copilot to retrieve a crafted email, follow its hidden instructions, and expose data available through connected Microsoft services. Microsoft patched the flaw before public disclosure and reported no known customer impact.[276] That is precisely the configuration Part 3 recommends most often, an assistant with access to mail and files, which is why §5.8's structural rule belongs in a non-technical company too. An assistant that reads untrusted input should not also hold broad, irreversible permissions.

None of this argues against the pilots in §3.3. It argues for the shape those pilots already have: small, measured, reversible, and judged on a metric you verified yourself rather than one the vendor supplied.

Part 4: The large law firm track

This part is for the large firm, written with the firm's risk posture in mind. Nothing here is legal advice, and none of it substitutes for your firm's own ethics counsel or your reading of the primary authorities. It is a practical map of what the market is doing and where the duties bite.

4.1 Why generic AI fails Big Law

A consumer chatbot is the wrong tool for a law firm, and the reason is the duty of confidentiality, not the quality of the model. The model is often excellent. The terms of service are the problem.

Free and consumer tiers frequently retain user inputs and may use them to train future models. Putting privileged client information into a tool with those terms risks the kind of disclosure that Model Rule 1.6 exists to prevent. The American Bar Association said as much in Formal Opinion 512 (July 29, 2024), which directs a lawyer to assess, before using any generative tool, whether the provider's terms allow it to retain or train on what the lawyer submits.[83] That single question rules out most consumer offerings on its own.

Confidentiality is the threshold issue, but it is not the only one. Generic tools lack the things a firm needs to use AI responsibly: an audit trail of what was asked and answered, citation validation against a real legal database, and a contractual guarantee that data is neither retained nor used for training. The enterprise legal products exist precisely to supply those controls.

Frame all of this as malpractice exposure, because that is what a risk committee will call it. A confidentiality breach through a tool's training terms, a fabricated citation that reaches a filing, or unverified AI output relied on as fact are each a path to a malpractice claim or a bar grievance, not merely a quality problem. The controls in this Part exist to keep that exposure inside the bounds the rules of professional conduct already require.

The hallucination stakes compound the problem. A model that invents a plausible case citation is a nuisance in most settings and a sanctionable event in a court filing. Damien Charlotin's public database of AI-fabricated-citation cases catalogued more than 1,200 globally by early 2026 and well over 1,600 by midsummer, growing by several a day. Section 4.7 has the current figures and the caveats on them.[89][251] Section 4.7 covers that risk in detail.

A chatbot every peer firm already has is not a differentiator. If every associate at every firm runs the same model, it raises the floor for everyone. That observation, which echoes through the market commentary, is what drives the largest firms to build rather than buy.[69]

4.2 The Harvey question

Harvey is the default answer to "what legal AI should we look at," and for many firms it is a reasonable one. It is also the company whose position best illustrates where the market is unsettled.

The facts first. Harvey raised $200 million in March 2026 at an $11 billion valuation, bringing total funding above $1 billion.[67][68] Its own account at that time described more than 100,000 lawyers across roughly 1,300 organizations in some 60 countries, and the company's current published figures are substantially higher, on the order of 200,000 lawyers and 2,400 organizations.[67][279] Press reports in August 2026 put Harvey in talks at a valuation around $15.5 billion.[279] Treat that as reported rather than closed, the same way you should treat the Legora figure below. It does contract analysis, due diligence, drafting, and research through chained agents, and in March 2026 it added a no-code Agent Builder that lets a firm assemble its own multi-step pipelines without engineers.[67]

Harvey does not publish per-seat pricing. Analyst estimates from Sacra put the base near $1,200 per lawyer per month for mid-market deployments with annual commitments, falling well below that for large Am Law volume deals.[69] These are secondary estimates, so treat any specific number as illustrative rather than quoted. Verified figures require direct negotiation.

The unsettled part is the business model. Harvey began with its own proprietary legal model, and according to the analyst firm Sacra it later moved to a model-agnostic approach after frontier models outperformed that proprietary system on Harvey's own internal benchmark.[69] That characterization is Sacra's, not Harvey's, so weigh it accordingly. The strategic question Sacra raises is whether an orchestration layer on top of frontier APIs faces commoditization pressure as OpenAI, Anthropic, and Google build legal-specific products directly.[69] Above the Law put the same worry more bluntly in March 2026, calling the current crop of legal tools "essentially AI wrappers" and predicting consolidation.[80]

Harvey is no longer the only well-capitalized answer. Legora, the Swedish competitor, raised $550 million at a $5.55 billion valuation in March 2026 in a round led by Accel, and its published customer list includes Cleary Gottlieb, White & Case, Linklaters, Goodwin, Bird & Bird, and Dentons.[249] Press reports in August 2026 put Legora in early talks at a valuation above $10 billion, which would nearly double its worth in four months.[249] Treat the $10 billion figure as reported rather than closed. The relevant fact for a buyer is not the valuation, it is that a second vendor now has enough capital and enough Am Law logos to be a real alternative in a competitive process. Run one.

The practical takeaway for a firm: Harvey is a credible buy, especially for getting capability into lawyers' hands quickly. But the "buy" decision should account for the possibility that today's vendor landscape looks different in two years, and it should be made against at least one serious competing bid.

4.3 Build, buy, or wrap

Most firms should buy, a few should wrap, and almost none should build from scratch. The right answer turns on scale, differentiation, and how much engineering the firm can actually sustain.

The buy case is the strongest for the large majority. A specialist vendor has already solved the confidentiality terms, the audit trail, and the legal-database integration. The much-cited MIT study of enterprise AI pilots found that buying from specialized vendors succeeded far more often than building in-house, though that study labeled its own methodology preliminary and has drawn criticism, so it is a directional signal rather than proof.[106]

The three subsections below walk the build-and-wrap options in order of increasing cost and risk.

4.3.1 Wrappers around Claude/OpenAI APIs

A wrapper is the fastest route to a custom tool: the firm builds its own interface and workflow logic on top of a frontier model's API, paying by the token rather than by the seat. Token pricing as of August 31, 2026 runs $5 per million input tokens and $25 output for Claude Opus 5, and $4 and $20 for GPT-5.6 Sol, with mid-tier options at roughly half those rates.[240][241] Harvey itself is, in effect, a sophisticated wrapper.

The economics of wrapping improved over the summer, which changes the build calculus. A firm that priced a wrapper against a $1,200-per-lawyer-per-month vendor seat in the spring should re-run that comparison, because the token side of it got cheaper while the seat side did not.

The appeal is control over the workflow without the cost of training a model. The risks are vendor lock-in, the engineering burden of maintaining the wrapper, data residency compliance, and the same commoditization pressure that the vendors face. A wrapper makes sense when a firm has a specific, repeatable workflow worth the engineering and an enterprise API agreement with confidentiality terms in place.

4.3.2 Fine-tuning on firm corpus

Fine-tuning, adjusting a model's weights on the firm's own documents, is the option most often proposed and least often worth it for knowledge injection. The evidence is unflattering. Stanford's FineTuneBench found that commercial fine-tuning APIs averaged only about 37% accuracy at absorbing new knowledge and far less at updating existing knowledge.[101] For getting firm-specific facts into a model, retrieval (pointing the model at your documents at query time) generally beats fine-tuning.

History offers a caution too. BloombergGPT, a 50-billion-parameter model trained on financial data, was overtaken by general frontier models not long after it shipped.[51] Fine-tuning still has a place for tone and format, and an open-weight model fine-tuned on-premises gives a firm physical control over its data. But it demands real machine-learning operations expertise and tends to trail the frontier on quality.

4.3.3 Full in-house model

Building a full proprietary platform is viable only at the very top of the market, where scale and differentiation justify the spend. The clearest example is Kirkland & Ellis, discussed next, whose reported commitment runs to $500 million.[63] For nearly every other firm, a from-scratch build is a way to spend a fortune reproducing what a vendor already sells. The MIT pilot data, contested as it is, points the same direction: most in-house enterprise AI builds do not pay off.[106]

4.4 What Kirkland and peers are reportedly building

The largest firms are building proprietary platforms, and the spending is substantial. Kirkland & Ellis is the headline. Bloomberg Law and Reuters reported in May 2026 that the firm committed roughly $500 million over several years to an in-house AI platform it does not intend to sell or license, with more than $100 million in the first year.[63][64] Coverage describes a team of around 180 technology professionals drawing on input from 250 lawyers, with roughly 50 dedicated AI engineers engaged so far.[63][65] Kirkland's chair is quoted, in secondary coverage that traces to a paywalled original, to the effect that off-the-shelf tools raise the floor for everyone but that clients do not hire the firm for the floor.[66] Treat the exact wording as reported rather than verified.

The build turned concrete in June. On June 4, 2026, Kirkland and Palantir announced a multiyear partnership to build an exclusive, proprietary fund enterprise platform for private capital fundraising, covering fund documentation, side letter drafting, obligation tracking, closing commitments, and ongoing compliance, with access for the firm's Investment Funds Group of more than 1,000 lawyers.[250] That is the most instructive detail in the whole Kirkland story, and it is easy to miss. The firm did not build a general-purpose legal assistant. It picked one high-margin, document-heavy practice where its own institutional knowledge is the moat, and it built there first. A firm with less than $500 million to spend can still copy the strategy: pick the single workflow where your accumulated know-how beats a general model, and build only that.

Other elite firms have taken different routes. Freshfields announced a multi-year partnership with Anthropic in April 2026, deploying Claude to 5,700 employees and co-building tools.[76] A&O Shearman was an early enterprise adopter of Harvey and co-built the ContractMatrix tool with Microsoft and Harvey, announced December 21, 2023.[221] Latham & Watkins rolled Harvey out firmwide on August 11, 2025, to more than 3,600 attorneys, though the deployment figures in wider circulation are breadth-level reporting rather than firm disclosures.[222] Several other firms are reported to be building internally. The specifics there are thinner and should be verified against primary sources before relying on them.

The pattern is a split. A handful of the largest, most profitable firms build to differentiate. Everyone else buys or wraps. The dividing line is whether a firm's scale makes a proprietary build cheaper than the strategic cost of using the same tools as its competitors.

4.5 Bridging chatbots and agentic coding

The frontier of legal AI is agentic: tools that plan a multi-step task and execute it across many documents, rather than answering one prompt at a time. This is the bridge between the chatbot a lawyer types into and the autonomous systems that engineers build.

Two developments mark the shift. Frontier models can now plan a job and run hundreds of parallel sub-agents in a single session, which makes document-scale or matter-scale work tractable. Claude Opus 5, released July 24, 2026, supersedes the Opus 4.8 model this section previously described, and dynamic workflows made the parallel-agent pattern a standard feature rather than something you assemble yourself.[239][245] And Thomson Reuters rebuilt CoCounsel on Anthropic's Claude software development kit as an agentic product in April 2026, serving a reported one million users across 107 countries, then shipped a next-generation CoCounsel Legal in August 2026.[73][74][255]

The integration layer is maturing alongside the models. In May 2026 Thomson Reuters launched a CoCounsel Legal MCP server that connects Claude and other MCP clients to CoCounsel Legal and the roughly 1.9 billion documents in Westlaw, which means the agent reasons over authoritative legal sources rather than its training data.[231] That is the difference between a model that sounds like a lawyer and one wired into the materials a lawyer actually cites.

The open-source side stopped being a signal and became a product. When earlier versions of this guide described Anthropic's claude-for-legal repository, it was an early indicator that legal AI was being packaged as workflow artifacts rather than generic chat advice.[215] On May 12, 2026, Anthropic shipped it as Claude for Legal, with twelve practice-area plugins, named workflow agents, and more than twenty connectors into legal systems of record.[248] Section 4.10.1 covers what that changes. The short version for a buyer: ask vendors what repeatable workflow assets they provide, and ask what those assets do that an open-source plugin from the model provider does not.

The distinction that matters for buyers is between genuine agents and marketing. A real agent plans, acts, runs its own tools or checks, and iterates without a human at each step. Much of what is sold as "agentic" is closer to chat with autocomplete.[73] Ask a vendor to demonstrate unattended multi-step execution, not a single clever completion.

Where these loops fail is predictable and worth designing against: ambiguous goals, missing stop conditions, and the absence of a human approval gate before any irreversible action.[89] For a firm, the approval gate is not optional. No agent should file, send, or commit anything without a lawyer signing off.

4.6 Compliance, audit trails, IP, work-product doctrine

The governing framework for a US firm starts with ABA Formal Opinion 512 (July 29, 2024), which maps generative AI onto existing duties rather than inventing new ones.[83] It implicates competence (Rule 1.1), confidentiality (Rule 1.6), communication with the client (Rule 1.4), candor to the tribunal (Rule 3.3), supervision of lawyers and nonlawyers (Rules 5.1 and 5.3), and fees (Rule 1.5).[83][84] The opinion's confidentiality guidance is the most operationally demanding: it contemplates informed client consent, beyond boilerplate engagement language, before client information goes into a self-learning tool.[83]

State authority has proliferated alongside the ABA opinion. California issued practical guidance in November 2023, and the New York City Bar published an opinion.[85][86] Avoid unsourced counts of state opinions because trackers group formal opinions, guidance, and proposed rules differently.

California also moved toward binding law. As of August 31, 2026, Senate Bill 574 remained an active bill in the Assembly floor process and was not law. The official text had last been amended on August 21.[252] That text would prohibit an attorney from delegating the practice of law to generative AI. It would also require reasonable steps to verify AI output, including case and statutory citations, and to correct erroneous or hallucinated material used by the attorney. For documents submitted to a court, it would require disclosure of AI use and personal verification of every filed citation. Separate provisions would restrict entry of nonpublic information and an arbitrator's delegation of decision-making.[252]

The status label matters as much as the substance: pending, not law. Check the current status and enrolled text on the California Legislative Information site before relying on the bill, because a floor vote, amendment, or veto can change both the obligation and its effective date.[252]

Three operational requirements follow. First, an audit trail: the firm should be able to reconstruct what was asked, what was returned, and who reviewed it. Second, a documented reasonableness analysis of the vendor's terms under Rule 1.6(c). Zero retention and no training on firm data are strong controls and worth negotiating for, but Opinion 512 requires a reasonable-efforts analysis rather than any specific contract term, and many compliant enterprise agreements retain data briefly for abuse monitoring.[83] The dangerous inference runs the other way: zero-retention terms do not discharge the duty, because Opinion 512 separately contemplates informed client consent for self-learning tools, and no contract term substitutes for that. Third, a clear human review step before any AI output reaches a client or a court.

Two things that Part 4 previously named and did not explain deserve their own treatment, because both are live exposure rather than background doctrine.

Billing is the exposure nobody budgets for. Opinion 512 addresses fees under Rule 1.5, and the guidance is more restrictive than most firms assume. A lawyer billing hourly may bill only time actually spent, may not bill for the time AI saved, and generally may not bill a client for time spent learning the tool.[83][280] Whether AI costs pass through to the client has to be disclosed in advance. And a flat fee left unchanged after AI compresses the underlying work can itself become unreasonable.[280] Read that against §4.8's instruction to measure real time saved: the saved time is a margin question and a client communication, not billable inventory. Before a practice group adopts a tool, revise the fee agreements, decide the cost pass-through, and tell the billers. Do it in that order, and do it before the first invoice rather than after the first fee dispute. I would treat these as reported summaries of the opinion and read the fee section of Opinion 512 directly before setting firm policy.

Confidentiality and privilege are different problems. Rule 1.6 is an ethical duty. Attorney-client privilege and work product are evidentiary protections with separate elements and waiver rules. A disclosure can satisfy an ethics policy and still lose a protection.

United States v. Heppner, No. 1:25-cr-00503-JSR, ECF No. 27 (S.D.N.Y. Feb. 17, 2026), supplies the warning that earlier versions of this guide missed. The court held on its facts that a represented defendant's consumer-Claude material was neither privileged nor work product. The defendant had used Claude on his own initiative rather than at counsel's direction, and disclosure under the consumer service's terms defeated confidentiality and waived any otherwise applicable privilege.[281]

That holding does not settle counsel-directed use under a negotiated enterprise agreement. A firm might argue by analogy to United States v. Kovel, 296 F.2d 918 (2d Cir. 1961), but Kovel is Second Circuit authority, not a universal third-party exception. It protects confidential communications made to obtain legal advice when the nonlawyer is necessary, or at least highly useful, to help the lawyer render that advice. It does not protect a client's use of a third party's own service merely because a lawyer is involved.[281]

Enterprise confidentiality terms can help prove those elements, but they do not create privilege. Contract for no training, tightly limited human and subprocessor access, deletion rights, and a defined legal-services purpose. Document counsel's direction and why the tool was needed. Then assume the enterprise-AI application of Kovel remains open until controlling authority says otherwise.[281]

4.6.1 Audit trails should include the workflow, not just the final text

A useful audit trail records more than the answer. It should identify the model, prompt, documents supplied, tools called, intermediate outputs that mattered, human reviewer, and final approval. In an agentic workflow, the path is part of the work product. If the firm cannot reconstruct that path, it cannot supervise the system in the way Opinion 512 expects.

One warning belongs next to the requirement because the requirement creates it. An audit trail is electronically stored information, but that label does not make every log discoverable or subject to a hold. Preservation begins when litigation is reasonably anticipated and extends to relevant material. Discovery then depends on relevance, proportionality, possession, custody or control, and privilege or work-product protection under Rules 26, 34, and 37. A privilege log is used for responsive material withheld on a protection claim, not for every record that reflects judgment.[281]

Build the log because supervision may require it, and build governance around it at the same time: a retention schedule, defensible suspension of destruction when a hold applies, matter-scoped access controls, and a process for reviewing responsive material. Treat those as risk controls, not categorical discovery rules.

This is now a procurement criterion you can test, not just an aspiration. Thomson Reuters' HighQ MCP server, released May 19, 2026, is built read-only, permission-controlled, and fully audit-logged, so every agent access to matter data is scoped and recorded.[232] When you evaluate a legal-AI connector, ask whether it logs every access, enforces existing matter permissions, and defaults to read-only. Those three properties are what turn an audit trail from a promise into evidence.

4.6.2 Redaction and anonymization are workflow controls

For sensitive matters, confidentiality may require changing the workflow before the model ever sees the data. Vendor patterns such as local anonymization, metadata stripping, and file-level filtering before an agent receives access are useful examples of the control layer.[211] Treat them as controls to evaluate, not magic shields: test whether the redaction survives realistic documents, logs, attachments, filenames, and tool outputs.

Two harder questions remain genuinely open. Who owns the output of a generative tool, and whether a lawyer's proprietary prompt sequences submitted to an external model enjoy work-product protection or are discoverable, are both being worked out in real time. There is no settled answer yet, and a firm should treat both as live risks rather than resolved doctrine.

4.6.3 Prompt discovery depends on who used the model and why

The 2026 cases do not point in one direction. They split by user, purpose, confidentiality, and the protection asserted.[254][281]

In Conservation Law Foundation, Inc. v. Shell Oil Co., a magistrate judge in the District of Connecticut ordered a testifying expert to produce generative-AI prompts used to filter document productions. The order treated the filtering as part of the expert's methodology, not as attorney prompts generally. The court stayed the production order while a Rule 72(a) objection was reviewed, so the order should not be described as an operative final answer.[254]

Other courts protected different material. In Morgan v. V2X, Inc., the District of Colorado held that Rule 26(b)(3) could protect a self-represented litigant's AI-assisted litigation preparation and that use of a third-party AI service did not automatically waive work product. The court still required the litigant to identify the platform and amended the protective order to restrict confidential information to services with specified contractual safeguards. In Assini v. Hayward, a New York court adopted similar reasoning and quashed a subpoena seeking a self-represented litigant's OpenAI account materials.[254] Heppner, discussed above, reached the opposite result for a represented criminal defendant who used consumer Claude without counsel's direction.[281]

The operational rule is to classify the use before predicting protection: attorney or client, represented or self-represented, litigation preparation or ordinary research, expert methodology or draft analysis, consumer terms or a negotiated enterprise agreement. Then apply the governing jurisdiction's actual privilege, work-product, expert-discovery, and protective-order rules.

Revise expert engagement letters now. State whether the expert may use AI, for what purpose, what must be retained, and what may be discoverable as methodology. For counsel and clients, record the legal purpose, terms, access controls, and direction of use. Do not delete a prompt history because it became awkward after a dispute. Apply the ordinary preservation analysis first.

4.7 Hallucination risk in legal filings: the Mata v. Avianca trap

The canonical cautionary tale is Mata v. Avianca, No. 22-cv-1461 (S.D.N.Y. June 22, 2023), in which counsel submitted a brief citing cases that did not exist, generated by ChatGPT. The court imposed a $5,000 monetary sanction jointly and severally against the two attorneys and their firm, payable to the court registry, and courts in the aftermath adopted standing orders requiring attorneys to certify they have verified AI-assisted content.[88][92] Describe Mata as a sanctions matter, because that is what the public record supports. Do not overstate it as a doctrinal holding on AI.

The problem did not stay contained to one case, and it is accelerating rather than fading. The Charlotin database tracked more than 1,200 fabricated-citation incidents worldwide by early 2026, and secondary trackers citing it reported figures in the 1,500 to 1,700 range by midsummer 2026, growing by several entries a day.[89][251] Norton Rose Fulbright, reviewing the 2026 record, counted more than 1,148 documented US attorney-hallucination cases.[251] I have not been able to pull a current total directly from the database, so treat the higher numbers as reported rather than verified, and check the database itself for today's count.

The size of the penalties moved too, but aggregate headlines hide important differences. In Couvrette v. Wisnovsky, the District of Oregon entered a $15,500 sanction on December 12, 2025 for fifteen fabricated citations and eight false quotations. A separate March 23, 2026 order awarded $94,704.38 in fees and costs. The combined $110,204.38 spans two orders, two remedies, and two calendar periods.[258] I could not reproduce a reported $145,000 first-quarter aggregate from primary orders, so this version does not repeat it.

The other Oregon authority is Doiban v. Oregon Liquor & Cannabis Commission, 347 Or. App. 742, 747–48 (2026), which imposed $10,000 for fifteen false citations and nine contrived quotations.[258] Earlier versions of this guide wrongly called that matter In re Ghiorso. William L. Ghiorso was counsel in Doiban. In re Ghiorso is a separate 2016 disciplinary matter. The correction belongs in the text because mismatching a real case name with a real sanction is exactly the failure this section warns about.

One finding from that review should reassure anyone waiting for a rule change to tell them what to do. Courts have not needed a generative-AI-specific rule. Existing Federal Rules of Appellate Procedure, Federal Rules of Civil Procedure, and state professional conduct rules have proved sufficient to sanction this conduct.[251] The duty you are already under is the duty that applies. Reported examples since Mata include a Sixth Circuit order in Whiting v. City of Athens (March 2026) imposing $15,000 per attorney plus opposing counsel's appellate fees for more than two dozen fake citations across three briefs, plus double costs and a disciplinary referral.[91][201][251] Whiting carries the same caveat this guide applies to Mata: reporting indicates the Sixth Circuit did not expressly attribute the fabrications to generative AI. It sanctioned the filing of unverified citations however they were produced. Calling it an AI case overstates the holding.[251] The 2026 record also includes a $2,500 fine in Fletcher v. Experian (Fifth Circuit, February 18, 2026), public admonishment in In re: Nwaubani (Fourth Circuit, March 11, 2026), and a public reprimand in Fivehouse v. DOD (E.D.N.C., April 27, 2026).[251] Not every case draws a sanction: in Gamez v. County of Fresno (E.D. Cal., April 9, 2026) the court imposed none.[251] The range runs from nothing to career damage, and which end you land on depends largely on whether you caught it first and told the court. One federal court applied Rule 11 sanctions for AI citation failures in Bunce v. Visual Technology Innovations, No. 2:23-cv-01740 (E.D. Pa.), where the court entered its sanctions memorandum and order on April 20, 2026, imposing $5,000 and mandatory AI-ethics continuing legal education on the sanctioned attorney.[278]

A word about that last citation, because it is the point of this section. An earlier version of this guide cited Bunce as "2025 WL 4231632 (E.D. Pa. Jan. 21, 2025)." That citation was wrong. The Westlaw number does not correspond to the opinion, and the date preceded the actual ruling by fifteen months. It came into the draft from a secondary source and survived several review passes, inside the section warning readers about exactly this failure. I caught it only when an adversarial review pulled the docket. Cases reported only through secondary sources must be verified against the docket before a firm cites them, and I am the proof rather than the exception.

Two lessons carry across all of these. Rule 11 responsibility attaches to the lawyer who signs, regardless of which tool drafted the text, so the duty to verify cannot be delegated to software. And using one AI to check another is not independent verification: in Mata itself, counsel asked ChatGPT to confirm the cases were real and it falsely affirmed them, which is exactly how the fabricated citations reached the brief.[88]

Checking that the case exists is not enough. Earlier versions of this guide said the safeguard was a human checking every citation against the primary source, and that sentence, followed literally, still gets lawyers sanctioned. Look at what the 2026 record actually punishes. Couvrette involved fifteen nonexistent cases and eight fabricated quotations. Doiban involved fifteen false citations and nine contrived quotations. Whiting involved fake citations and misrepresentations of the record.[258][251] Existence-checking catches the first failure in each pair and none of the second. Run four checks on every citation in anything you file:

1. The case exists, verified in Westlaw, Lexis, or the court's own docket.
2. Every quoted passage appears verbatim at the page cited.
3. The case actually supports the proposition it is cited for.
4. The case is still good law, checked in KeyCite or Shepard's.

Check the assigned judge's standing order before every filing. Many courts and individual judges have adopted orders on AI use, and they are not uniform. Some require a certification that AI-assisted content was verified, some require disclosing which tool was used, some require identifying the AI-assisted passages, and some prohibit AI use in submissions outright. They vary judge to judge inside a single district. This is not something to leave to a lawyer's memory, so make it a field in the docketing system alongside the page limits and the font rules.[282] A proposed Federal Rule of Evidence 707 would have applied a reliability gate to machine-generated evidence. On May 7, 2026, the Evidence Rules Committee declined to advance the proposal, substantially revised it, and held it for further study. It has no effective date and appears on no pending amendments list.[282]

Have a protocol for the fabricated cite you discover after filing. Model Rule 3.3(a)(1) addresses a lawyer's knowing false statement to a tribunal and the failure to correct a prior material false statement. Paragraph (b) applies when the lawyer knows that a person is engaging or has engaged in criminal or fraudulent conduct related to the proceeding. It does not govern every citation mistake.[83]

The response depends on the jurisdiction, posture, materiality, client duties, court rules, and insurance policy. Stop relying on the affected submission, preserve relevant records, verify the scope of the error, and obtain local ethics or malpractice advice on correction, client communication, court notice, and carrier notice. Treat that sequence as a risk protocol, not as a claim that one rule requires immediate notice to every recipient in every case.

4.8 Realistic adoption roadmap: 90 / 180 / 365 days

Before any of what follows, audit your outside counsel guidelines. Some clients' guidelines may restrict AI use, require consent or vendor disclosure, or change what may be billed. I did not locate a defensible prevalence survey, so this version makes no claim about how common those provisions are.[283] Read the actual guidelines for your largest clients, decide what requires notification or consent, and do that before signing the vendor agreement.

A staged rollout beats a firmwide switch, and the right shape is pilot, then scale, then build. The pattern below is a generic adoption sequence adapted to a firm's risk posture, not a sourced law-firm roadmap.

In the first 90 days, get the governance and a narrow pilot in place. Sign an enterprise agreement with zero-retention and no-training terms, stand up an AI use policy grounded in Opinion 512, and pilot one well-bounded workflow, document summarization or first-pass research, with a single practice group. Measure real time saved, not the feeling of speed.

By 180 days, expand what worked and formalize review. Widen the pilot to more groups, build a shared prompt library and a context base of the firm's templates and standards, and make the human-verification step a documented part of the workflow rather than an informal habit.

By 365 days, decide on the build-or-buy question with evidence in hand. By now the firm knows which workflows deliver value and at what cost, which is the only sound basis for deciding whether to wrap a model, invest more heavily in a vendor, or, for the largest firms, build. Adoption discipline matters throughout: tools that sit unused deliver nothing, so usage is the metric that determines return.

4.9 The Finnegan / Davis Polk / Desmarais comparison

These three firms illustrate three distinct postures, and the contrast is instructive precisely because not all of them have disclosed much.

Finnegan, an intellectual-property firm, sits at the most documented end. In September 2025 it launched a formal client-facing practice, AI + Finnegan, with four teams spanning AI and patents, copyright, privacy, and trade secrets, and named partner leads.[204] On the internal side, the firm's own disclosures describe an AI tech-tools committee of partners, technologists, and risk staff, a knowledge-management and innovation team, and prompt-engineering training for its lawyers.[205] Those internal details come from Finnegan's own materials rather than outside reporting, and the firm has not named the specific tools it uses, so read the program as the firm presents it.

Davis Polk's public posture leans toward thought leadership and advisory work. Named partners write and speak on AI across the industry, and the firm runs a standing AI advisory practice, but it has not disclosed a flagship internal build.[78] That is a legitimate strategy: lead the client conversation, and adopt deliberately.

Desmarais LLP is the honest negative case. It is an IP-litigation boutique known for alternative fee arrangements, and the available research found insufficient public information about any specific generative-AI deployment. Rather than infer a strategy from silence, the accurate statement is that its posture is not publicly documented.

The comparison's real lesson is about evidence. Two of these firms have visible programs and one does not, and a firm evaluating its own path should weigh what peers actually disclose against what gets asserted in vendor marketing.

4.10 Legal AI as packaged workflow assets

The practical future of legal AI is not a blank chat box with a better model behind it. It is packaged workflow assets: matter-intake checklists, citation verification harnesses, privilege-review procedures, redaction pipelines, research rubrics, and approval logs. That is the difference between a lawyer experimenting and a firm operating.

The June scrape reinforced this. The strongest legal signals were not "ask the model to be a lawyer" prompts. They were repositories, templates, and agentic systems that encode how legal work should move from source material to reviewed artifact.[215] A firm should treat these assets like practice infrastructure: version them, review them, assign owners, and test them on known examples before using them on live matters.

When a vendor pitches workflow assets, look for the parts that survive contact with a malpractice question. A short checklist:

• Citation verification against a real database, not the model checking its own output. Ask which database, and whether every cite in a generated document is checked or only a sample.
• An audit trail of the whole workflow, not just the final text: the prompt, the model and version, the sources retrieved, and who approved the result. Section 4.6 explains why the workflow log matters more than the output alone.
• Redaction and anonymization as a step in the pipeline, so privileged material is handled by control rather than by the user remembering to strip it.
• A named human approval gate before anything reaches a client or a court, with the approver recorded.
• Version control and ownership on the asset itself, so a checklist or rubric has an owner, a change history, and a test set of known examples.
• Contractual data terms in writing: no training on firm data, defined retention, and zero-retention available on request.

If a vendor cannot show these, the asset is a demo, not infrastructure.

4.10.1 Claude for Legal, and what an open workflow library changes

The clearest example of packaged workflow assets arrived on May 12, 2026, when Anthropic released Claude for Legal: an open-source suite of practice-area plugins covering commercial, employment, privacy, corporate, and AI governance work, a large set of named workflow agents, and more than twenty connectors into the systems firms already run, including iManage, NetDocuments, Ironclad, DocuSign, LexisNexis, Thomson Reuters CoCounsel, Relativity, and Everlaw.[248] Freshfields, Quinn Emanuel, and Holland & Knight were named as using Claude on live matters at launch.[248] It is available to paid Claude customers rather than sold as a separate tier, and enterprise administrators control which pieces are enabled.[248]

Three things about this matter more than the product itself.

It resets the price of the workflow layer. When practice-area scaffolding ships open-source from the model provider, a vendor charging separately for the same scaffolding has to justify the premium on something else: proprietary data, verified retrieval, insurance, support, or an audit trail you can hand a regulator. That is a useful question to put to any legal-AI vendor in a procurement conversation now.

It moves the risk from drafting to configuration. Plugins are starting points, not firm policy. A plugin encodes somebody's general view of how employment counsel work should proceed, and your firm's playbook is not that view. Treat a plugin the way §4.10 says to treat any workflow asset: version it, assign it an owner, adapt it to firm precedent, and test it on matters where you already know the right answer.

It makes connector permissions the live control. Several of these connectors write as well as read, into e-signature and document management systems that hold the operative versions of client documents. Before enabling any of them, confirm the permission scope, confirm the zero-retention and no-training terms the confidentiality analysis in §4.6 requires, and put a named human approver in front of any action that sends, files, or executes. A read-only connector is a research tool. A write-enabled connector is an agent acting in your client's name.

4.11 Litigation workflows worth running now

Everything above is about governance. This section is about the work. Six litigation workflows moved from demo to production in 2026, and each one has a named tool and a specific failure mode a litigator has to own.

Brief drafting with a citation-verification harness. Thomson Reuters launched the next generation of CoCounsel Legal on August 20, 2026, including a Westlaw brief builder and a verification pass that checks cited propositions against the underlying source.[255] This is the first widely available product that does what §4.10's checklist demands rather than describing it. Do not mistake grounding for immunity. The Stanford RegLab study remains the only preregistered public benchmark of citation-grounded legal tools, and it found hallucination rates in the 17% to 33% range.[255] No independent 2026 re-test has published, so the vendor's accuracy claims are unaudited.

E-discovery review, now bundled rather than premium. Relativity made its generative review and privilege-detection features standard in RelativityOne, Everlaw made single-use AI tasks free, and DISCO shipped an agentic tool that plans and runs multi-step fact investigations.[256] The economics of first-pass review changed as a result, which is the single largest cost line in most litigation budgets. The control does not change: an agent that autonomously searches, filters, and ranks still needs QC sampling against a validated seed set before anyone certifies a production as complete, and a privilege call remains a lawyer's call.

Deposition preparation and transcript analysis. CoCounsel, DISCO, and Everlaw all now generate deposition outlines and witness-testimony summaries.[255][256] The failure mode here is quiet and dangerous. A summary that omits an impeaching contradiction or softens an admission is worse than no summary, because it produces confidence rather than doubt. Spot-check every summary against the transcript before it shapes an examination.

Chronology and fact development. Agentic tools now extract dated facts from a document set and assemble a source-cited chronology.[256] Errors cluster where you would expect: a fact on the wrong date, or attributed to the wrong document, because the model misread a Bates stamp or a poorly scanned exhibit. Verify each entry against the page before a chronology reaches a mediation brief.

Judge and opposing-counsel analytics inside general chat tools. Trellis connected its state trial court dataset to Claude in May 2026 and to ChatGPT in July 2026, which moves analytics that used to live in a specialist platform into the tool a lawyer already has open.[257] Treat the outputs as base rates rather than forecasts. Using a grant-rate statistic to set a client's expectations or settlement authority, without saying out loud how thin the matching sample is, is a Rule 1.4 problem waiting to happen.

Medical record and damages review. First-pass extraction of medical records into litigation-ready chronologies is now a product category rather than a service.[256] The asymmetry is brutal: an AI that misses a pre-existing condition hands the gap to opposing counsel, who will find it. Clinical human review of flagged records is not optional, and vendor claims of 40% to 60% cost reduction are sales figures, not audited benchmarks.

One pattern runs through all six. In every case the tool compresses the first pass and leaves the judgment, and in every case the failure mode is a confident omission rather than an obvious error. Omissions do not announce themselves the way a fabricated citation does. Build the sampling step into the workflow, because you will not notice you needed it.

Part 5: Building with code

This is the part I live in. If you write software, or you want to, the AI tools have moved from autocomplete to something closer to a junior engineer who never gets tired. The catch is that the people getting the most out of them are not the ones with the cleverest prompts. They are the ones who set up the workspace carefully before they ask for anything. Everything below is about that setup.

5.1 The philosophy: plan first, scaffold deliberately

The single biggest predictor of a good result is how much context the model has before it starts, so I spend more time on setup than on the prompt itself. Anthropic calls this context engineering, and the framing is useful: the model's context window is a budget, and your job is to spend it on the few things that actually steer the output toward the right answer.[115] A model with the right files in front of it and a clear goal beats a smarter model working blind.

Plan before you generate. For anything past a one-file change, I write down what I want, let the model draft an approach, and only then turn it loose on code. The cost of a wrong plan is a few minutes of reading. The cost of a wrong implementation is an afternoon of unwinding it.

This is not a fringe practice anymore. Anthropic reports that as of May 2026, more than 80% of the code it merges into its own codebase was authored by Claude.[230] That number only holds because the work is scaffolded and reviewed, not because the model is turned loose unsupervised. The scaffolding is the point.

Scaffold deliberately means the project has a shape the model can read. Clear file names, a short description of what each part does, and a written goal. The model is good at filling in a well-defined frame and bad at inventing the frame from a vague request. Give it the frame.

In production, the prompt is only one surface. The schema, tool description, validator, memory layer, and eval set are also part of the prompt because they all shape what the model can do. Use the prompt for business meaning, audience, evidence rules, and edge cases. Use schemas for machine-readable shape. Use validators and evals to catch the parts language alone cannot reliably enforce.

5.2 Starter pack: design.md, identity.md, PRD, AGENTS.md, CLAUDE.md

A handful of plain markdown files in the repo root will do more for output quality than any prompt trick, because they turn one-off instructions into standing context the model reads every time. Andrej Karpathy popularized the idea of keeping an LLM-readable wiki for a project, a living set of notes written for the model rather than for a human team.[56][128] Here is the set I keep.

This is the coding version of the same Projects rule from Part 3. If the agent has file access, put context in files and direct it to those files. Do not paste the same design notes, screenshots of requirements, or long source files into the chat every time. The repo is the project memory. The chat is the workbench.

design.md is the architecture in prose. What the system does, the major pieces, how they fit, and the decisions you have already made so the model does not relitigate them.

identity.md is the voice and the non-negotiables. For a writing project it is the style guide. For a product it is the tone, the naming conventions, and the things you never want the model to do.

A PRD (product requirements document) is the what-and-why of the feature you are building right now. Even a half-page keeps the model aimed at the real goal instead of a plausible adjacent one.

AGENTS.md is the cross-tool instruction file. It has become a rough standard that several coding agents read, so it is the right place for build commands, test commands, and conventions that any agent touching the repo should follow.

CLAUDE.md is the Claude Code equivalent, read automatically at the start of every session. Mine holds routing rules, tool preferences, and the mistakes I do not want repeated. These files override default behavior, so the more precisely you write them, the less you have to repeat yourself.

You do not need all five on day one. Start with CLAUDE.md or AGENTS.md and a design.md, and add the others when you notice yourself giving the same instruction twice.

As the project grows, add decisions.md for choices already made, open-questions.md for unresolved issues, sources.md for provenance, templates.md for reusable prompts or formats, and handoff.md for the current session state. Add files because repeated context needs a home, not because a checklist says every repo must have them.

5.3 Plan mode: when it beats just-do-it

Use plan mode whenever a wrong first attempt would be expensive to undo, and skip it when the task is small and reversible. Claude Code's plan mode has the model research and propose an approach without touching files, so you sign off before any code changes. The research bundles do not give a single decision rule here, so this is my own working heuristic.

Plan first when the change spans several files, introduces a new system, or touches anything you cannot easily roll back. The plan is cheap to read and cheap to correct, and catching a bad assumption there saves a full rewrite later.

Just do it when the task is one file, well-bounded, and easy to revert with git. Forcing a planning round on a two-line fix is its own kind of waste. The tell is reversibility: if git can undo it in one command and you would notice the mistake immediately, skip the ceremony.

5.4 Ralph loops and /goal: when iteration beats one-shot

For work where the right next step depends on what the last step produced, an iteration loop beats a single big prompt. The pattern that made this concrete is the Ralph loop, named and popularized by Geoffrey Huntley: you give the agent a goal and a stop condition, and it runs the same prompt against its own evolving output until the goal is met.[62] People have driven runs for many hours this way, with the agent fixing, testing, and re-fixing without a human in the seat for each turn.[61]

Anthropic later shipped an official ralph-wiggum plugin for Claude Code that formalizes the technique through a stop-hook, so the loop is now a supported pattern rather than a clever hack.[187] On the Codex side, the /goal command plays a similar role, letting you hand over an objective and let the tool iterate toward it.[58]

The danger with any unattended loop is that it runs forever and burns tokens with nothing to show. So every loop I run has four guardrails: a hard turn budget, a wall-clock deadline, a completion marker the loop can detect to know it is done, and a forward-progress check that halts the run if two turns in a row produce nothing new. Make that progress check read a number the model does not write: passing tests, items remaining, diff size. I tested the alternatives on synthetic loop histories, and plain repeated-output detection caught only one of four stall shapes, missing oscillation between two states and the expensive case where the agent produces different plausible text every turn while nothing improves. A July 2026 static analysis backs the worry with found defects rather than a rate: scanning 6,549 agent repositories, it confirmed 68 unbounded-loop failures across 47 projects, each one a repeated path that no effective bound covered.[296] It analyzed source code, not live runs, so it shows the gap exists, not how often it bites. Without these guardrails, an agent loop can quietly spend an enormous amount of money making no progress. With them, iteration is the best tool for fuzzy, long-horizon work.

One boundary to be honest about: these guardrails bound waste, not blast radius. Nothing in a turn budget stops a loop from deleting the wrong thing well inside its budget. Action-level safety comes from §5.8: scoped credentials, sandboxes, separation of production from everything an agent touches, and approval gates on anything destructive or externally visible.

The honest test for whether to loop at all: if the task could plausibly succeed on a scheduled runner with no model in the loop, write a plain script instead. Save the agent loop for work where the success criterion is not yet mechanical.

5.5 Context management: compact, handoff, artifacts, and vaults

Context is the scarce resource, and managing it well matters more than picking a slightly better model. Models degrade as their context fills, an effect Anthropic and others have documented as context rot: the same model gives worse answers late in a long, cluttered session than it does early in a clean one.[126][115] So the skill is keeping the window full of the right things and empty of everything else. Appendix G distills this section into a checklist you can run before any long chat or agent run.

Three moves cover most situations. Compact when you need to keep going in the same session but the window is heavy. A targeted compaction that preserves the slice you care about and crushes the rest is better than a blanket one. Handoff to a fresh session when the current task is self-contained and the accumulated context would only confuse it: write a short brief, commit any pending work first, and start clean. Fresh window between unrelated tasks, always. Shared context across two different jobs degrades both.

The handoff is the habit that makes fresh windows painless. Before moving to a new chat, ask the model to write a self-contained brief: goal, current state, files or project context to read first, decisions already made, what not to redo, open questions, risks, and the next concrete action. Paste that into the new window instead of dragging the whole old transcript with you.

Compaction itself is lossier than it feels, and now there is a measurement. One practitioner ran a decay probe on a small model (Claude Haiku 4.5 through the Claude Code command line): seed ten synthetic facts, delete their source file, force repeated compactions. Zero of ten facts survived the first boundary, and 106 of 108 later summaries carried none. The two exceptions prove the rule. The agent's own grep accidentally re-read the facts from a file on disk, they returned for two summaries, and one re-summarization later they were gone again. The summarizer even reported it had kept all ten while carrying zero.[301] One author, one model, one CLI version, so hold the exact counts loosely, but the split is the lesson: a fact that must survive belongs in a file the session re-reads, or in a hook that re-injects it at every boundary, never in the conversation alone.

The general principle behind these moves is the same one from 5.1. The window is a budget. Long-running agents that succeed are the ones that keep retrieving the right context at the right moment rather than carrying everything forward.[116][118]

Persistent artifacts are the fourth move. A knowledge vault gives the agent a place to put durable facts, decisions, open questions, and source notes so the next session does not have to rediscover them.[209] For complex reviews, an HTML artifact can outperform a markdown transcript because it can hold a plan, diff, tables, screenshots, diagrams, and reviewer controls in one navigable surface.[207] The rule is simple: keep conversation light, put durable work in files, and make the next agent read the file instead of the whole chat. One warning before you build the vault: files an agent re-reads as instructions are also an attack surface. Section 5.8 covers memory poisoning and the review discipline that answers it.

The budget principle has one measured exception at the small end. For material an agent needs on every turn, a small always-loaded index beats knowledge gated behind a tool the agent must decide to invoke: on one vendor's eval of deliberately post-cutoff framework APIs, an 8KB always-loaded index passed every case where the gated version plateaued at 79%, because the agent often never decided to look.[302] At library scale the economics flip toward single-level retrieval, and adding a deeper routing layer can actively hurt: a July 2026 controlled study measured one harness's multiple-choice accuracy collapsing from 0.91 to 0.64 under an extra hierarchy, while at twenty-book scale flat indexing reached nearly double the open-ended accuracy at half the cost.[303] Small and always-needed loads up front. Big and occasional gets one flat index, retrieved when needed. Test before adding anything deeper.

Skill graphs need one more routing rule. If the knowledge is shared across projects, keep it in a standalone knowledge base and point agents to it. If the knowledge belongs to one product, keep it in that repo's docs or a repo-local knowledge graph. If you put a graph under .claude/skills/, use a small index or trampoline file and keep deep knowledge nodes out of the skill-description budget. Skills should trigger procedures. Knowledge files should hold facts. When those two blur, agents start loading the wrong thing at the wrong time.

The routing rule is:

I also like a lightweight tripwire: after roughly 25 prompts, or before starting a heavy new subtask, ask whether the next move belongs in the current window at all. If the work is mechanical, delegate it. If it will produce noisy search output, send it to a separate worker. If the current window is full of unrelated history, write a handoff and start fresh. If none of those apply, stay put.

5.6 Sub-agents and tier sizing

Delegate independent subtasks to sub-agents, and match the model tier to the job rather than reaching for the biggest model every time. A sub-agent runs a scoped task in its own context window and returns just the result, which keeps the noisy middle of a search or a bulk edit out of your main session.[117] When several subtasks are independent, you can run them at once.

Tier sizing is the discipline that keeps this affordable. The rule I use is to pick the cheapest model that can do the subtask well:

• Haiku for bulk mechanical work with no judgment: mass file edits, simple aggregations, format conversions.
• Sonnet for scoped research, code exploration, and in-scope synthesis. This is the default tier and handles most work.
• Opus for subtasks that need real planning, architecture decisions, or multi-step tradeoffs.

Two guardrails keep the pattern from sprawling. Cap the spawn depth so a sub-agent can spawn at most one further tier, and do not escalate to a bigger model without a concrete reason. The parent session owns the final answer and stitches the pieces together. Most of the time the right move is several Sonnet agents in parallel, not one Opus agent doing everything.

Tool support varies. Some coding tools have native sub-agents. Others need you to launch separate CLI jobs, background workers, or fresh sessions. The principle is the same either way: isolate noisy work, give each worker a narrow brief, and bring back only the result.

The orchestration step is now automated in at least one tool. Anthropic announced dynamic workflows for Claude Code on May 28, 2026, and they are now generally available: instead of you deciding how to split the work, the model writes an orchestration script and runs tens to hundreds of parallel sub-agents in one session, including agents whose job is to refute what the other agents found, iterating until the answers converge.[245] I used this pattern to pressure-test this version of the guide, and it caught a pricing error I had introduced from a secondary source.

Two cautions before you reach for it. Anthropic's own documentation warns that dynamic workflows consume substantially more tokens than an ordinary session.[245] And fan-out is the wrong shape for work that is genuinely sequential, where each step depends on the last. Use it when the work splits into independent lanes or when you want several independent readings of the same question. Use a single session when the work is a chain.

Skills and sub-agents solve different problems. A skill is reusable know-how for a class of work: "prepare a diligence memo," "audit accessibility," or "run the team release checklist." A sub-agent is a temporary worker for one scoped task. Use skills when the same workflow will recur. Use sub-agents when the work can split into independent lanes. Use both when a sub-agent needs a known procedure.

5.6.1 Mixed-model and multi-agent review

Use multiple models when the task has judgment risk, hidden assumptions, or several plausible answers. The pattern is generate separately, compare structurally, then synthesize. Ask Model A and Model B for independent answers, keep their outputs separate, and run a comparison pass that extracts agreement, conflicts, missing evidence, and unique ideas. OpenRouter's Fusion description is the productized version of this workflow: fan out to several models, then use a judge to identify consensus and contradictions.[206] One caution on that product shape: the consensus half is the half the measurements below undercut. Use the fan-out for the contradictions it surfaces, not for the comfort of agreement.

Do not use model agreement as proof. A study of over 350 models found that on one leaderboard dataset they agreed about 60% of the time when both were wrong, and that error correlation rises as models get more capable, across vendors and architectures.[291] A separate 2026 study across five models and four truthfulness datasets found no aggregation trick, majority voting included, reliably beat asking one model once, even at up to 25 times the inference cost.[292] An audit of three-model panels on a standard benchmark found voting beat the panel's own strongest member less than 10% of the time.[293] Agreement is not a check. Disagreement is a usable flag, though: in one structured clinical-extraction study, the lowest-agreement 6.5% of items held roughly 80% of all annotation errors, so routing just that slice to human review would have caught most mistakes at a fraction of the effort. One site, one language, one narrow task, and the authors say so.[294] The value of mixed-model review is that it exposes uncertainty faster than one chat does. It is most useful for research synthesis, legal issue spotting, architecture tradeoffs, strategy memos, and any task where "one fluent answer" is too smooth to trust.

For code and data work, the strongest version is writer and reviewer separation. Have one agent write the patch, migration, or analysis. Have a second agent from another model family review only the diff, tests, contracts, and likely edge cases. The reviewer should not rewrite the work by default. Its job is to say: ship, fix these specific issues, or stop because the risk is higher than the change is worth.

The mechanism behind the separation matters. A second look inside the same session shares the writer's context and catches little, the self-correction limit measured back at ICLR 2024: without external feedback, models fail to find their own reasoning errors and sometimes get worse on a second pass.[192] So separate the review context, prefer another model family, and ground the verdict in something external, tests, retrieval, a compiler. And treat the model reviewer as a biased instrument, not a neutral one: in a peer-review simulation, model reviewers accepted model-written papers at 78% against 49% for human-written papers on identical topics.[295]

5.7 Where to host: AWS vs Cloudflare vs local LLM

Match the host to the workload: a big cloud for heavy or compliance-bound systems, an edge platform for lightweight global apps, and a local model when privacy or cost rules out sending data anywhere. The cloud comparison below is general guidance rather than a benchmarked recommendation.

AWS and the other large clouds make sense when you need deep service integration, heavy compute, or specific compliance certifications, and you are willing to manage more infrastructure to get them. Cloudflare and similar edge platforms suit lightweight, globally distributed apps where you want low latency and minimal ops, with the tradeoff of a more constrained runtime. For most small projects, the edge option is the faster path to something live.

Local LLMs are the interesting third option, and the tooling is now good enough for real use. Ollama is the easiest on-ramp for running an open model on your own machine, LM Studio gives you a friendly interface, and vLLM is the choice when you need serving throughput: on Red Hat's benchmarks it served roughly 793 tokens per second at peak against Ollama's 41, an order-of-magnitude gap that only matters once you are serving many users at once.[152][153] The open models worth running locally are mostly Meta's Llama family and a handful of others, which are capable enough for many tasks without an API call leaving your hardware.[38] You host locally when the data cannot leave, when you want to eliminate per-token cost, or when you simply want to own the whole stack. The price is that you manage it, and the best open models still trail the frontier hosted ones.

5.8 Security: secrets, .gitignore, MCP risk surface, prompt injection

Treat anything an AI agent can read or run as part of your attack surface, because it is. The basics first: keep secrets out of the repo, put .env and credential files in .gitignore, and never paste live keys into a prompt. Stage specific files by name rather than committing everything blindly, so a stray secret does not ride along.

MCP (Model Context Protocol) is the connector standard that lets agents reach external tools, and it widens the risk surface in ways worth understanding. Security researchers have catalogued real problems: authentication that the protocol treats as optional, over-broad tool permissions, token handling that exposes credentials, tool-description poisoning, and a remote-code-execution pattern in a widely used MCP SDK that OX Security disclosed in April 2026. The researchers estimated more than 7,000 public deployments in the affected supply chain, but execution depended on downstream software accepting attacker-controlled STDIO configuration. That estimate is not a count of proven compromises. Anthropic characterized the underlying behavior as expected rather than shipping a protocol-level patch, which puts the burden on you to lock down each deployment.[100][137][135] The NSA's May 2026 security guidance flags that an MCP session can carry broad ambient authority, where a connection authenticated once keeps acting with that access across a whole session, so harden scope and permissions at deployment time rather than assuming the default is safe.[111] The practical rule is least privilege: give a connector only the access it needs, and review what each one can actually do before you trust it.

Two things changed over the summer, one good and one alarming. The good one: the MCP specification revision published July 28, 2026 rewrites the protocol as stateless request and response rather than long-lived bidirectional sessions, hardens OAuth with issuer validation and audience-bound tokens, and deprecates dynamic client registration in favor of client ID metadata documents.[259] That revision targets precisely the ambient-authority problem the NSA flagged, so if you deployed MCP before August 2026, the upgrade is a security fix and not a feature release.

The alarming one: the first large-scale dynamic audit of internet-facing MCP servers, published July 31, 2026, found more than 21,000 discoverable servers, and of those it audited dynamically, 91.8% had no OAuth at all and 687 tool instances exposed raw shell access.[260] Those are not misconfigured hobby projects on the margin. That is the modal state of publicly reachable MCP infrastructure. Before you connect an agent to a third-party MCP server, assume it is unauthenticated unless you have checked.

Prompt injection is the one to internalize. A malicious instruction hidden in a web page, a document, or a tool result can hijack an agent that reads it, turning your own assistant against you. It sits at the top of the OWASP list of large-language-model risks for good reason.[114] You cannot fully prevent it yet, so the defense is structural: do not give an agent both untrusted input and broad, irreversible permissions at the same time, and keep a human in the loop for anything destructive or externally visible. If a tool result looks like it is trying to give you instructions, treat that as the alarm it is.

That structural rule has a gap, and researchers found it in July 2026. Agent data injection plants fake delimiter and punctuation characters inside structured data fields rather than planting instructions in prose, which corrupts what an agent trusts as legitimate metadata rather than what it reads as text.[261] The disclosed technique worked against Claude Code, Claude in Chrome, OpenAI Codex, Gemini CLI, and Google Antigravity in their default configurations.[261] Watching for instruction-shaped text does not catch it, because nothing in the payload looks like an instruction. The mitigation is a different category: sanitize the boundary between trusted and untrusted data, and do not let a data field silently become a control character.

The most durable variant is memory poisoning, and it targets exactly the file-based memory this guide recommends. Every file an agent auto-loads as instructions, memory files, CLAUDE.md-class project files, knowledge wikis, skills, is a persistence layer an attacker can write to once and profit from every session afterward. In April 2026, Cisco researchers demonstrated a malicious npm package appending attacker instructions to a Claude Code memory file during install. The poisoned lines loaded at every session start, and the compromised agent recommended insecure practices, committing API keys to source among them, persistently and with nothing visible to the user. Anthropic changed how memories load in response, in Claude Code v2.1.50.[307] Two related Claude Code vulnerabilities, both since patched, ran hook commands from project files the moment a workspace was trusted, with none of the per-command confirmation a user would expect, and redirected API traffic, credentials included, through an environment-variable override.[308] The defense is to treat memory and knowledge files as code: keep them in version control, review their diffs like any other change, and audit anything that can write to them, package installs and hooks first.

Vendors are starting to ship this structural defense as a product setting. OpenAI's Lockdown Mode, rolling out from June 4, 2026, disables web browsing, image generation, Deep Research, Agent Mode, connectors, and downloads in one switch, which removes most of the channels an injected instruction needs to do damage, and its Elevated Risk labels flag sessions where untrusted content raises the exposure.[228] Anthropic shipped the structural counterpart on August 5, 2026: inference hooks, in beta, hold every governed prompt across Claude, Cowork, and Claude Code for an allow or deny verdict from the organization's own security server before inference proceeds, and log denials to a compliance activity feed.[262] For a regulated organization, that is the difference between a policy document and an enforced control, and it is the kind of thing to ask about in procurement.

The lesson for your own builds is the same whether you buy it or build it: the fewer capabilities an untrusted-input session can reach, the smaller the blast radius. Anthropic's own containment writeup publishes the reason the model layer cannot stand alone: on an external red-teaming benchmark, for one model version, injection resistance of roughly 0.1% attacker success on single attempts rises to about 5 to 6% under a hundred adaptive attempts.[309] So deterministic boundaries back the probabilistic one: an OS sandbox that denies network by default and confines writes to the workspace, plus a separate approval gate for actions beyond it. Those figures are the vendor's own. The architecture lesson stands without them: layer the model, the sandbox, and the treatment of external content as adversarial, so no single miss is a full compromise.

5.9 Agent primitives: browser, tools, skills, sandboxes, evals

A lot of useful capability is available as free or open APIs, but the deeper shift is that agent systems now have reusable primitives. Models are one primitive. Tool calls, browser sessions, skills, sandboxes, eval manifests, and knowledge stores are the others.

Browser automation is the clearest example. A browser skill can package selectors, XHR/API knowledge, login/session expectations, and a repeatable workflow so an agent does not rediscover the site every time.[212] Skills do the same for local work: a scoped instruction bundle tells the agent when to trigger, what context to read, and how to perform a narrow class of work. Anthropic's official skill docs make the storage pattern concrete: a skill can carry instructions, scripts, and resources, and good skills stay concise, structured, and tested against real usage.[237] Sandboxes keep code execution and untrusted inputs away from secrets. Eval manifests make the result repeatable by recording the prompt, model, tools, inputs, and scoring rubric.[210]

Tool descriptions deserve the same care as user prompts. A good tool description says when to use the tool, when not to use it, what inputs are required, what precondition must be true, and what the model should do with the result. Sloppy tool descriptions are a quiet source of bad agent behavior because they teach the model the wrong affordances.

Some of these primitives now ship built into the model APIs themselves. Google's Gemini API exposes a URL Context tool that fetches and grounds on the pages you name, and OpenAI's Responses API ships built-in web_search and computer-use tools, so retrieval and browsing become a flag rather than a separate service.[229] Google has also moved a full agent harness into the API: Managed Agents can run in isolated Linux environments, execute code, use tools, and be defined with AGENTS.md and SKILL.md files.[236] Reach for the built-in primitive before you wire up your own when the provider already offers it.

On the model side, the open-weight families, mostly Meta's Llama models, can be run yourself or accessed through hosted providers, which gives you a fallback that does not depend on a single vendor.[38][39] Beyond models, the pattern that pays off is connecting an agent to the specific data sources your work depends on through MCP, so the model is reasoning over your real information rather than its training data. The pricing and exact capabilities of individual public APIs move too fast to pin down here, so check the current terms before you build on one.

5.10 Operator patterns from the field

The best workflow ideas often appear in repositories and practitioner forums before they reach official documentation. Use those places as an intake queue, not as an authority. The companion Operator Field Notes keeps the fast-moving layer separate from the durable guide and grades every pattern as reproduced, corroborated, promising, anecdotal, or retired.

Six patterns have earned a place here: five on independent corroboration, and the prompt compiler on its mechanism, with its efficacy still an open question.

Compile the prompt before execution. Section 2.8 gives the everyday version. For serious work, let a planning model interview you and write a standalone prompt containing the objective, inputs, constraints, non-goals, output format, acceptance tests, verification steps, and stop conditions. Review that file, then give it to a fresh executor. A separate reviewer gets both the prompt and the result.[287] Label the evidence honestly: no published study measures this pattern against direct prompting, and heavy structure can hurt the newest models.[310] In my own small test the compiler surfaced constraints I had missed and still omitted the acceptance tests and stop conditions, so the review of the compiled prompt is the stage that earns its keep.

Run loops with state and backpressure. A reliable Ralph loop selects one bounded backlog item, starts a fresh session, loads the prompt and learned guardrails, makes one change, runs objective checks, records state, and repeats. The core mechanics, fresh context per task and small reviewed changes, are documented across independent repositories,[284] and the most complete implementation separates prd.json, prompt.md, and guardrails.md, then halts on repeated output or stalled progress.[285] Section 5.4 covers why the progress check must read an external metric.

Let a referee declare done, never the worker. Completion needs a machine-checkable convergence type. One practitioner essay names four: a named test scope passes, an iteration produces zero diff, a queue reaches zero, or a separate model scores against a rubric, the weakest of the four.[297] Two clarifications keep those four honest. Zero diff counts as convergence only when a passing acceptance check comes with it, because zero diff with a flat or failing check is the stall §5.4 halts on. And judge-defined ranks last only when the judge scores prose against a bare rubric. Section 5.6.1's reviewer earns more trust because its verdict is grounded in diffs and tests. The process that declares done-ness must not be the process that did the work. One practitioner puts it plainly: the model that writes the code is not the model that decides whether the code is done.[298] A community writeup of Codex's goal state machine describes the same split shipped: the model can create and complete a goal, but pause and budget transitions stay system-controlled.[299] For unattended loops, make the contract itself checkable: a public JSON Schema requires every loop to declare its verification receipts, budget, escalation, and exit conditions before it runs, and its runnable example logs each outcome as an append-only receipt with an evidence digest.[300] The schema checks shape, not sense, so a human still reads the contract once.

Make knowledge lintable, and know what lint cannot catch. The functional triad from §1.4.1 combines immutable raw sources, a model-written wiki, and a human-governed schema. Ingest, query, and lint are equally important. The linter catches unsupported pages, stale claims, broken links, and contradictions before the wiki quietly becomes a new source of confident error.[286] The linting ecosystem has matured: independent implementations now converge on similar rules, and the best-verified one hashes each cited raw source into the note's frontmatter, so the linter flags drift between what a claim cites and what the source now says.[304] Know the boundary, though. In my own reproduction, structural rules caught missing provenance, stale dates, orphan sources, and an invented statistic, and a quietly strengthened verb passed every automated check. Structural lint is mechanical. Overclaim detection above that level needs a model or human comparison pass, which is what the claim ledger below is for. One practitioner taxonomy names six kinds of wiki drift, among the most serious being citation drift, where a page still cites a source but the claim no longer matches it.[305] My own addition to that list is the self-citation loop: once the wiki references its prior synthesis instead of raw sources, internal consistency stops being evidence of correctness. Treat a wiki that reads more smoothly every month as a thing to lint, not a thing to trust.

Turn disagreement into retrieval. When agents disagree, split the dispute into atomic claims and fetch the primary source. Do not vote. When they agree, still verify any claim whose cost of being wrong is high. Shared training data lets several models repeat the same mistake, and §5.6.1 now carries the measurements: correlated errors rise with capability, aggregation fails to beat a single sample, and low agreement concentrates real errors well enough to direct review effort.[291][294] This pass supplied its own worked example. Two research agents returned opposite signs for the same statistic, and only re-quoting the primary source settled it.

Keep a claim-to-evidence ledger. For every consequential factual claim, record the exact supporting passage, source, retrieval date, scope of support, and unresolved contradictions. Citation resolution proves that a source exists. The ledger tests whether it supports the sentence. Recent systems research uses claim-evidence graphs and structured provenance interfaces for the same reason,[289][290] and a third independent group has now measured the approach: an evidence-ledger agent that labels each claim-evidence pair and routes unsupported claims back to the author during drafting correctly labeled 67.6% of pairs on a 2,335-row blind benchmark, against 38.3% for the best non-agent baseline.[306]

The remaining field patterns are operating disciplines rather than tricks: convert repeated corrections into tests or guardrails, give unattended work separate outcomes for verified completion and unverified completion, and increase autonomy through shadow mode with promotion gates written down before the shadow period starts. Compare tools by cost per accepted artifact rather than tokens or seats, with the label read out loud: it is an emerging discipline with one named proponent, not an industry standard.[311] The first practitioner benchmark supports the mechanism, one fixed feature across 23 model-and-harness combinations cost between $2.59 and $34.82 per merged result, and the cheapest model by token price was not the cheapest by merge. The same benchmark's review gate approved code failing up to 26 of 38 unit tests, so define "accepted" with hard checks before the metric means anything.[312] The companion holds the experiments and failure modes so this section can stay short.

The throughline of this whole part: the payoff is in the scaffolding, not the sentence you type. Set up the context, pick the right tier, guard the loops, and the tools will carry more than you would expect.

Part 6: Reference matrices

This part is the quick-reference. Three tables you can scan without reading the prose around them, each with an as-of date because all of it moves. When a table and your own test disagree, trust your test. Benchmarks age in weeks.

6.1 Model matrix (task to recommended model)

As of August 31, 2026. Pick by the job, not the headline ranking, because the leads are narrow and they rotate.[26] Prices are per million tokens, input then output. Every row here matches the model list in §1.2. If you find one that does not, §1.2 is the one I updated first.

Two cautions on this table. Grok 4.6's 500K context window is half or less of every other frontier model listed, so it is the wrong pick when the job is reading one enormous document.[243] And Gemini's price is introductory: it doubles on January 1, 2027, so build the budget on $1.50 and $7.50.[242]

The reframe from Part 1 still holds: a frontier model can cost six times more per word than a cheaper rival for output that scores within a few points. Save the expensive model for the work that earns it.

6.2 Coding and agent-surface matrix

As of August 31, 2026. These are the coding agents and adjacent work surfaces: terminal agents that read your repo and run commands, AI-native editors, shared workspace agents, managed cloud agents, and browser-skill layers.

Claude Cowork is a related but distinct product: a desktop agent that works across your files and documents rather than a repo-and-terminal coding tool.[217] It belongs on the consumer-agent rung of the ladder in §2.12. OpenAI's Codex app is the desktop counterpart to the Codex CLI: it lets you supervise several Codex agents at once rather than steering one terminal session, and it added Windows support in March 2026.[225]

One convergence is worth naming, because it changes where the work happens rather than how well it goes. Over the summer of 2026 all three major agent surfaces added remote or mobile session control: Claude Cowork reached web, iOS, and Android in July, OpenAI's Codex Remote went generally available across ChatGPT plans in late June, and Google's Antigravity added remote control on August 20.[263] The session keeps running on the machine that holds your files and credentials while you steer it from a phone. That is convenient, and it also means an agent with full local access is now reachable from a device that is easier to lose. Treat phone access to an agent session as equivalent to laptop access, and secure it the same way.

The pattern worth repeating from Part 5 is that agent surfaces are becoming file-shaped. Claude Code reads CLAUDE.md, Codex standardizes on AGENTS.md, Google's Managed Agents can use AGENTS.md and SKILL.md, and skills turn reusable procedures into files.[236][237] The scaffolding you write once steers every session.

6.3 Connector / MCP matrix (job to connector)

As of August 31, 2026. A connector, usually built on MCP (Model Context Protocol), is what lets an agent reach a real tool or data source instead of reasoning over its training data alone.[100] Match the job to the connection, and give each one only the access it needs.[111]

The security rule from Part 5 governs this whole table: never give one agent both untrusted input and broad, irreversible permissions at the same time, and keep a human in the loop for anything destructive or externally visible.[114]

Appendices

Appendix A: Glossary

Plain definitions for the terms used in this guide. One sentence each, in the sense this guide uses them.

• Agent. A model that can take actions, like reading files or calling tools, not just answer in a chat box.
• Agent operating surface. A workspace that coordinates model calls, context, tools, agents, review, and logs rather than treating one chat as the whole job.
• Agentic loop. A pattern where the agent runs, checks its own result, and runs again toward a goal until a stop condition is met.
• AGENTS.md. A project instruction file that several coding agents read on startup, holding build commands and conventions.
• Benchmark. A standardized test of model ability, useful for rough ranking and easy to game, so treat scores as directional.
• Browser skill. A reusable package of browser-specific instructions, selectors, and workflow knowledge that lets an agent repeat a web action reliably.
• CLAUDE.md. Claude Code's project instruction file, read automatically at the start of every session.
• Compaction. Compressing a session's history to free up context while keeping the parts that matter.
• Connector. A bridge that lets a model reach an external tool or data source, usually built on MCP.
• Context engineering. The practice of deciding what to put in the model's limited context window so it produces the right answer.
• Context rot. The tendency of a model to give worse answers as its context fills with long or cluttered history.
• Context window. The amount of text a model can hold in view at once, measured in tokens.
• Eval manifest. A record of the prompt, model, inputs, tools, expected behavior, and scoring rubric for a repeatable AI test.
• Few-shot prompting. Showing the model one or more examples of the output you want so it copies the format and register.
• Fine-tuning. Further training a base model on your own data to specialize it, distinct from prompting or connecting it to live data.
• Frontier model. The newest, most capable tier of model from a given lab.
• Grounding. Attaching a model's answer to live, citable sources rather than its training data alone.
• Hallucination. A fluent, confident output that is factually wrong, a structural feature of how these models generate text.
• Knowledge base (LLM wiki). A set of notes maintained for the model to read, popularized by Andrej Karpathy.
• LLM (large language model). A model that generates text by predicting the next token from patterns in training data.
• MCP (Model Context Protocol). The connector standard that lets agents reach external tools in a consistent way.
• Mixed-model comparison. Running the same task through multiple models and comparing agreement, contradictions, gaps, and unique insights before synthesizing.
• Multimodal. A model that handles more than text: images, audio, video, or PDFs together.
• Open weight. A model whose trained parameters you can download and run yourself, which is not the same as fully open source.
• Per-seat pricing. A flat monthly fee per person, the right shape for humans using a chat app.
• Per-use pricing. Billing per million tokens, the right shape for software that calls the model automatically.
• Plan mode. A mode where the model proposes an approach without changing files, so you approve before any code runs.
• Prompt injection. A hidden instruction in untrusted input that hijacks an agent that reads it.
• Ralph loop. An unattended iteration loop, named by Geoffrey Huntley, that reruns a prompt against its own output until done.
• Skill. A reusable instruction bundle that tells an agent when and how to perform a narrow class of work.
• Sub-agent. A scoped helper that runs one task in its own context window and returns just the result.
• Tier sizing. Picking the cheapest model that can do a subtask well: Haiku, Sonnet, or Opus.
• Token. The unit models read and bill by, roughly a few characters of text.
• Zero-retention. A contract term where the vendor does not store or train on your data.

Appendix B: Prompt and workflow patterns with examples

These are copy-paste templates for the techniques explained in Part 2. The full reasoning lives there. This is the quick card. Fill the bracketed slots.

For the fuller standalone version, see companions/prompt-engineering-mega-guide.md. For context management, handoff prompts, and project-file patterns, see companions/context-management-guide.md.

The universal prompt contract. Use when the task matters.

Help me [goal]. Context: [facts]. Audience: [who will read/use this]. Success criteria: [what good looks like]. Evidence rules: [what sources may be used]. Format: [desired shape]. If anything is uncertain, say so instead of guessing.

The meta-prompt. Have the model write the prompt, then run it.

Write me a prompt I can give an AI to [goal]. The situation is: [context]. I want [tone, length, and output format].

Show, do not tell (few-shot). Paste an example and ask for more in the same shape. The last example carries the most weight, so put your best one last.

Here are two status updates I liked: [example 1] [example 2]. Write this week's update in the same format and tone: [this week's facts].

Specify the output shape. Name the exact structure you want back.

Give me this as a table with three columns: risk, likelihood, and mitigation. No more than six rows.

Ask for graduated confidence. Get the model to mark what it is unsure about.

Answer, then mark each claim: confident, believe-but-uncertain, or insufficient information. Do not guess past what you know.

Provide sources, then ask for citations. Cuts fabricated references.

Using only the documents I pasted above, answer [question] and cite the specific document for each claim. Do not use outside sources.

Describe the method, not the credential. Beats "you are an expert in X."

Before suggesting a position, identify the other party's likely priorities and constraints, then propose a position that advances my goal while acknowledging theirs.

Generate, then self-critique. One or two passes only.

Now critique that draft. What is weak, incomplete, or possibly wrong? Then rewrite it to fix those issues.

Cross-check across two models. Run the same prompt through a second model. Agreement provides only weak evidence. Disagreement is a reliable flag to verify by hand.

Surface conflicts instead of smoothing them over. Use this when a source set or model panel may disagree.

Compare these answers/sources. Return four sections: consensus, contradictions, claims needing verification, and unique useful ideas. Do not synthesize until after the comparison.

Set a token or turn budget. Keeps agentic work from wandering.

Work toward [goal] for at most [N] turns or [N] tokens. Stop early if two consecutive turns make no new progress. At the end, report done, blocked, or needs human decision.

Set full agent guardrails. Use before an agent works for more than a few turns.

Goal: [objective]. Scope: [in bounds]. Out of scope: [do not touch]. Budget: [turn/token/time cap]. Checkpoints: after each major step, record what changed, what evidence supports it, and what remains. Stop if complete, blocked, two steps make no progress, or irreversible action is needed. Ask before any externally visible or destructive action.

Run writer/reviewer. Use when correctness matters more than speed.

Writer: implement [specific change] within [files/scope]. Run [checks]. Reviewer: read only the diff, contracts, and test output. Return: ship, fix specific issues, or stop. Do not rewrite the patch unless asked.

Close out agent branches. Use when agents create branches or result docs.

End the result doc with one closeout line: CLOSEOUT: APPLIED, WIP, SUPERSEDED-BY: [branch-or-commit], ABANDONED, or MERGED. No other states. The next session should know whether to keep, delete, or inspect the branch without reading the whole diff.

Turn research into schema. Use when sources should change a database, scorecard, rubric, or decision framework.

Extract research variables first: observable facts, metrics, dimensions, opinions, contradictions, source, and confidence. Group them into decision variables. Then list schema implications, scoring implications, missing data, and human decisions needed. Do not change schema from research alone.

Triage a long-running batch. Before running agents unattended, classify each task.

Make an HTML artifact. Useful when the output needs navigation, tables, diagrams, diffs, screenshots, or reviewer controls.

Create a single HTML artifact that shows the plan, evidence table, open questions, and final recommendation. Make it reviewable without reading this chat transcript.

Compare models structurally. The everyday version of mixed-model review.

I will paste answers from multiple models. Compare them by agreement, conflict, missing evidence, risk, and best combined answer. Do not assume agreement means correctness.

Document a reusable team prompt. Use this before a prompt becomes shared operating infrastructure.

Create a prompt-library entry with: name, owner, use case, required inputs, model, prompt text, output format/schema, examples, known failure modes, review checklist, last-tested date, and version.

Describe a tool safely. Tool descriptions are prompts too.

Use this tool only to [specific purpose]. Do not use it for [nearby non-purpose]. Inputs must include [required fields]. Before calling, confirm [precondition]. After calling, summarize [result shape].

Start a fresh chat inside a Project. Use project files as durable context instead of re-uploading files.

Use the project files as durable context. Read [file] for [purpose], [file] for [purpose], and [file] for [purpose]. This is a fresh chat for [task]. If the project context is insufficient, ask what to read next.

Write a handoff prompt. Use whenever a new window or model takes over.

Write a self-contained handoff prompt for a fresh window. Include: goal, current state, files or project context to read first, decisions already made, what not to redo, open questions, risks, and the next concrete action. Keep it under 1,000 words.

Write a code handoff. Use before a fresh coding-agent session.

Write a handoff brief for a fresh coding-agent session. Include repo path, branch, current goal, what changed, what remains, files to read first with why, commands already run and results, known risks or failing tests, safety or don't-touch rules, and the exact continuation prompt. Do not include raw diffs or long logs.

Check citations and factual claims. Use before relying on research, legal, medical, or financial output.

Extract every citation, URL, case name, statute, statistic, date, price, and named source. Mark each as verified from provided source, needs manual verification, or likely unsupported. Do not invent missing citation details.

Recover from a bad answer. Use when the output is vague, too confident, stuck, or smooth but useless.

Re-review the answer for vague claims, overconfidence, missing evidence, unsupported assumptions, and unclear next steps. Return a table with issue, severity, evidence, and suggested fix. If the chat context is stale, produce a clean handoff prompt for a fresh window instead of continuing.

One caution carried from Part 2: telling a model "do not make things up" can backfire by making the unwanted behavior more salient. Say what you want instead.

Appendix C: Cost cheat-sheet

As of August 31, 2026. Prices churn every few months, so re-verify before you budget on them. See Part 1.3 for the reasoning behind the per-seat versus per-use split.

API token prices, per million tokens, input then output:

Discount mechanics are provider-specific. OpenAI distinguishes cache reads from cache writes and adds separate long-context input and output surcharges above 272,000 input tokens. Anthropic and Google use different cache, storage, Batch, and context rules. Price the exact request shape rather than multiplying the base rate by a universal discount.[239][240][241][242][243]

Consumer subscriptions:

Business per-seat:

The one number to remember: the spread between the most and least expensive output in that first table is more than forty to one, while the benchmark gap between the top and the middle is a few points. Match the model to the job.

Appendix D: Further reading

The primary sources worth reading in full, grouped by what they help with. Full citations are in the bibliography.

Model landscape, straight from the labs:

• Anthropic, Claude Fable 5 and Opus 4.8 model documentation.[223][1]
• OpenAI, GPT-5.5 announcement.[8]
• Google, Gemini 3.5 Flash model and pricing pages.[224]
• xAI, Grok 4.3 documentation.[202]

The two big shifts:

• Andrej Karpathy's knowledge-base gist, the wiki idea that started it.[56]
• Geoffrey Huntley on the Ralph loop, plus Anthropic's official ralph-wiggum plugin that formalized it.[62][187]
• Simon Willison on Codex's /goal command.[58]

Building well:

• Anthropic, "Effective context engineering," the framing behind Part 5.[115]
• Anthropic, "Introducing the Model Context Protocol."[6]

Security:

• OWASP Top 10 for large-language-model applications.[114]
• The NSA's guidance on hardening MCP deployments.[111]
• Li and Gao, the MCP security survey.[100]

For lawyers specifically:

• ABA Formal Opinion 512 (July 29, 2024), the governing guidance on a lawyer's duties when using generative AI.[83]
• Damien Charlotin's database of AI-fabricated-citation cases, the running public record of where this has gone wrong.[89]
• California SB 574 and similar state measures, for where AI-disclosure obligations are heading.[95]
• The Stanford FineTuneBench study on the limits of fine-tuning for factual recall.[101]

Learning the tools:

• Anthropic, Learn, the official learning hub linking the Academy courses for both users and builders.[235]

Appendix E: Changelog

The canonical, maintained changelog is CHANGELOG.md in this directory, which records research imports and structural changes. The drafting history of the guide text itself:

This guide is a living draft. Model names, prices, and product details carry an as-of date because they move every few months. Re-verify anything time-sensitive before relying on it.

Version cadence. This guide follows semantic versioning, and the release triggers are fixed so the credibility of the as-of dates does not depend on guesswork. A patch release (0.0.x) goes out when a listed price moves by more than 10%, when a named product is renamed or retired, or when a citation breaks. A minor release (0.x.0) goes out when a major lab ships a new flagship model that changes the rankings in Part 6, or when a full Part gains or loses a section. A major release (x.0.0) is reserved for a structural rewrite or a change in who the guide is for. Part 6 is the designated maintenance target and may be patched on its own while the rest of the guide holds stable. Routine price and ranking drift that crosses no threshold is batched into the next scheduled review rather than shipped piecemeal.

Review cadence. A full review runs quarterly regardless of whether a trigger has fired, so nothing time-sensitive ages out unnoticed. The review re-verifies every price, model ranking, and product name against its source, checks that each [N] footnote still resolves, and confirms the as-of dates in Part 1, Part 6, and Appendix C. Between quarterly reviews, the triggers above govern: a price move or a renamed product ships as a patch when it is caught, without waiting for the calendar. Anything flagged during a review but not yet resolved is recorded in this changelog so the next pass picks it up.

Appendix F: Source bibliography

The master bibliography is research/_sources.md, a single deduplicated list of 332 numbered entries compiled across the research bundles. Every numbered footnote in this guide, written as [N], keys to that file. The rendered HTML and DOCX editions inline this list as a navigable References section, so each [N] links straight to its source.

Sources are grouped there by category for browsing, then numbered consecutively across the whole list. Entries that churn, such as model versions and pricing, are flagged as time-sensitive and should be re-verified before publication. The bibliography is maintained separately so footnote numbers stay stable as the guide grows.

Social posts and practitioner threads have a narrower role. They can support workflow patterns, vocabulary, and emerging user behavior. They should not be used as the sole source for model performance, pricing, legal obligations, security controls, product availability, or regulatory claims. Those need a primary source or a clearly labeled secondary source.

Appendix G: Context Management Checklist

Use this before a long chat, a new coding-agent run, or a handoff to another model. Section 5.5 explains the reasoning behind each item.

• Put stable context in project files or repo files, not in chat history.
• Start a fresh chat for each distinct task.
• In chat apps, use Projects or equivalent workspaces for recurring work.
• In code, point the agent to AGENTS.md, CLAUDE.md, design.md, prd.md, decisions.md, or the narrow files it needs.
• Before switching windows, ask for a handoff prompt.
• The handoff should include goal, current state, files to read, decisions made, what not to redo, open questions, risks, and next step.
• Compact only when continuing the same task in a heavy window.
• Assume compaction drops conversational facts. Anything that must survive belongs in a file the session re-reads or a hook re-injects.
• Use a fresh window when the task changes or the chat has gone sideways.
• Save durable outputs as markdown, HTML, JSON/YAML, CSV, or repo files.
• Keep raw sources separate from model-written synthesis.
• Review diffs to memory and knowledge files like code. They load as instructions.
• Keep procedures in skills and facts in knowledge files.
• Use SKILL_MAP or an equivalent routing table for human-readable skill discovery.
• Keep skill libraries curated and description-rich rather than large and vague.
• Use writer/reviewer separation for risky code, data, legal, or strategy work.
• Require closeout tags for agent-created branches or result docs.
• Before unattended runs, classify tasks as auto-apply, manual review, or human decision first.
• Turn repeated workflows into candidate skills only after the pattern recurs.
• Do not paste secrets, giant logs, whole repos, or multiple unlabeled drafts into context.
• For research, keep raw/, notes/, claims.md, contradictions.md, open-questions.md, and synthesis.md separate.
• End long sessions by asking what should be saved, discarded, read first next time, not redone, and done next.