9
Picture the scene a year from now: a partner asks the firm’s assistant agent to summarize a discovery set. The assistant, doing its job, quietly reaches the conflicts agent. The conflicts agent checks the intake agent. None of them asked permission. None of them logged the exchange. All three just handled privileged material, and no human ever saw the conversation happen.
That is not a distant scenario. That is the trajectory every firm is walking toward the moment it stops treating AI as a set of islands and starts wiring the islands together. The individual tool was manageable. The network of tools is not.
Here is why the handoff — not the model — is where your exposure lives:
1. The handshake is where privilege dissolves. A disclosure isn’t only what you send to another firm. When one agent trades context to another agent, that context has moved to a system executing under terms you were never shown. Two private conversations that were never risky individually become one exposed pipeline the moment they connect.
2. Nobody reviews the relay. Most firms have learned to gate the human-facing tool behind a reviewer. Almost none have built the equivalent control for the agent-to-agent call that happens with no person in the room. Your approval layer was designed for people pushing buttons — not for machines quietly rerouting files between themselves.
3. The blast radius compounds. A single leaking agent is not one leak. It feeds every downstream agent it touches, and each of those feeds the next. One weak point fans out across the whole fleet before a single human notice lands. Containment goes from “fix one thing” to “reconstruct an entire chain of custody” after the fact.
4. Accountability becomes an orphan. When agent A hands work to agent B, which summarizes for human C, who is the responsible professional on that matter? Professional duty follows the work, and the work just got divided among machines no human supervised. Every firm has someone accountable when things are slow and manual. Almost none have named who is accountable when the work is fast and autonomous.
5. The counterparty count multiplies silently. Every model you do not run yourself is an unexamined counterparty with its own retention, jurisdiction, and terms. Two cooperating external agents are two external counterparts touching one matter. You cannot audit what you cannot enumerate, and right now the list is growing without anyone keeping it.
The counterintuitive part is that the fully connected firm is the more secure one — if the connections are yours. The danger was never automation. It was automation running on infrastructure the firm does not control and cannot see. A firm that runs its own agents on its own hardware gets the speed of the network and the proof of the audit trail at the same time. The firms being outrun are not the ones with agents but the ones whose agents are strangers to governance.
As models get more capable, the instinct will be to assume they get more trustworthy. Capability and confidentiality move apart, not together. The frontier is pushing harder than ever on efficiency — which means the handoffs are about to get faster, more frequent, and far less visible. The only durable position is to make sure every relay stays inside the walls before you let anyone press the on button for the machine that does not work alone.
The fix is not to ban agents — the efficiency is real, and banning it would simply push the habit underground. The fix is to make every handoff visible and sovereign: agents running on hardware you control, inside walls you own, with a log of every relay and a human named at the top of the chain. When the intelligence never leaves your building, the question of who touched it has an answer you can actually produce.
If you are not sure whether your systems are still islands or already a quietly connected web, that is exactly what a structured look is for. Five minutes, no risk, and you will see precisely what your firm is exposing right now.