The AI Brief, Issue 3, November 2026.
Yes. A new study this month showed AI systems hunting for AI contract vulnerabilities, the kind of gaps a human lawyer might take years to spot. The real risk isn’t that AI breaks the law for you. It’s that someone else uses AI to find the exit clause in your vendor agreement, the undocumented process a regulator asks about, or the policy gap an insurer flags after a claim.
What’s new about AI contract vulnerabilities?
Researchers this month treated legal text the way security researchers treat code: searching for exploitable gaps instead of intent. That’s a different kind of search than a lawyer doing a careful read page by page. It’s automated, it runs at a scale and speed a manual review can’t match, and it doesn’t care how long the document is.
For a small or midsize firm, that means the contracts and compliance documents you haven’t reopened since you signed them are now searchable in a way they never were before. The ambiguous clause nobody noticed when it was signed is exactly the kind of thing this approach is built to find, and it won’t only be your side running the search.
What else happened in AI and security this month?
Three stories from the past few weeks show the same pattern from different angles.
- The UK’s National Cyber Security Centre warned that AI powered ransomware will ramp up by 2028, aimed first at critical infrastructure. Small businesses sit in the same supply chains as those targets, so this isn’t an enterprise only problem, it’s a timeline for everyone connected to that supply chain.
- Attackers are hiding malware inside signed copies of ChatGPT and Claude, the exact tools your staff already trust and already have open on their desktops. For a firm this size, it means the icon on the taskbar is no longer proof of anything, and where the install came from matters as much as what it’s called.
- Google reported that LLMjacking, criminals hijacking company AI accounts to run their own workloads, has cost some businesses up to a million dollars. For a smaller firm, the number will be smaller, but the mechanism is identical: someone else runs their compute on your account and your card gets the bill.
Why does owning your memory matter more than the model?
Each of those stories points at the same lesson: the model doing the searching this year gets replaced by a better one next year. Your documented standards, your reviewed contracts, your own record of what good looks like, that’s the part that stays yours no matter which vendor’s tool you use next.
Own your memory, rent the intelligence. Judge every AI decision this year on two questions: does this build memory you keep, and does it run inside a harness you control, meaning approved tools, permissions, review gates, logging, and a hard stop on anything irreversible. Tools that fail both are rented convenience. Tools that pass both compound.
Even the big players are leaning this direction. Litera’s owner Hg and Anthropic just backed a new AI transformation venture aimed squarely at responsible adoption in legal work. That’s a signal that the standards you set now for reviewing AI output will matter more, not less, as the tools get better.
What should you do about this in the next month?
Picture a firm that hasn’t reopened its vendor contracts since the day they were signed. Two moves close most of that gap without hiring anyone new.
- Pull your top vendor and client contracts and have counsel check them for the kind of ambiguity an automated search would flag first.
- Put a human review gate in front of anything AI drafted, a clause, a policy, a client letter, before it goes out the door.
This is the kind of review gate TC³ builds for clients, alongside the access controls and logging that make the paperwork hold up when a regulator or insurer actually asks. TC³ doesn’t replace your lawyer or your insurer, but it keeps the technical side, access, logging, what gets reviewed before it ships, ready for the question. Start with The 5 Biggest Cybersecurity Mistakes Small Businesses Still Make in 2025, read past issues in the AI Brief archive, browse the AI and automation learning center, or check how this applies to your sector on the AI adoption and security risks page. If this issue landed in front of you secondhand, subscribe here to get the next one directly.
Lawyers bill by the hour. AI reads your contract in seconds. Choose your worry accordingly.
Researched and drafted with AI, then reviewed and approved by Ron Trotto before publishing.