A VentureBeat study published in January 2025 found that 54% of enterprises have already experienced an AI agent security incident. Most of those breaches traced back to a single point of failure: AI tools sharing login credentials across systems.

If your law firm uses AI for intake, document review, or client communications, you’re probably exposed right now. The good news is that fixing this doesn’t require a six-month security overhaul. It requires an audit, a policy, and separate access controls for every agent you deploy.

The credential-sharing problem in plain English

Most law firms that adopt AI start with a single login. Someone on the team creates an account for ChatGPT, Claude, or a legal research assistant, then shares the credentials with the rest of the firm. Partners use it for drafting. Associates use it for research. Paralegals use it for intake summaries.

The tool works. Everyone saves time. No one thinks about what happens when that one login touches three different systems: your case management platform, your document storage, and your email.

Here’s what happens. The AI assistant now has access to everything that login can see. If the tool is compromised, or if an employee leaves and the password isn’t changed, or if a phishing attack succeeds, the breach isn’t limited to one inbox. It’s firm-wide.

We’ve seen this play out in three ways. First, a departing associate takes the shared login and continues accessing client files for weeks before anyone notices. Second, a phishing email tricks a paralegal into re-entering the shared credentials on a fake login page, and the attacker uses that access to scrape discovery documents. Third, an AI tool with overly broad permissions accidentally exposes privileged communications in a summary it generates for a different matter.

None of these scenarios required a sophisticated attack. They happened because one login had too much access and no one treated the AI agent as a separate user with its own permissions.

Why law firms are especially vulnerable

Law firms handle two types of data that make credential sharing catastrophic: privileged communications and personal client information. Both are protected by ethics rules and, in many cases, by statute.

When you give an AI assistant access to your email, it can read attorney-client correspondence. When you connect it to your document management system, it can pull contracts, discovery files, and settlement agreements. When you integrate it with your intake form, it can see names, contact details, and the reason someone called your firm.

If that AI tool shares a login with five people, you’ve just multiplied your exposure by five. If one of those people clicks a phishing link, the breach affects every client file the tool has touched.

The risk isn’t theoretical. We’ve worked with two mid-sized litigation firms in the past year that discovered their AI research assistant had been logging into their case management platform using the managing partner’s credentials. The tool had access to every active matter, every closed file, and every billing record. When the firm finally audited access logs, they found the assistant had been pulling documents for matters it had no reason to touch.

The firms weren’t breached, but they were one credential leak away from a malpractice claim and a bar complaint.

What an AI agent security audit looks like

An audit doesn’t mean hiring a forensics team or spending $40,000 on a penetration test. It means sitting down for 60 minutes and answering three questions: which AI tools have access to your systems, what credentials they’re using, and whether those credentials are shared with humans.

Start with a list. Write down every AI tool your firm uses. Include the obvious ones like ChatGPT and legal research assistants, but also include the less obvious ones: your intake chatbot, your email summariser, your contract review plugin.

For each tool, identify the login. Is it a shared firm account? Is it tied to one person’s email? Is it using OAuth to connect to other systems, or is it storing a username and password?

Then map the access. What can that login see? If it’s connected to your case management platform, can it read every matter or just the ones assigned to a specific attorney? If it’s connected to your email, can it send messages on your behalf?

Finally, check the logs. Most platforms let you export a list of recent logins and actions. Look for access patterns that don’t match how your team actually works. An AI tool that’s pulling documents at 3 a.m. on a Sunday is either doing background processing or it’s been compromised.

If you find shared credentials, the fix is straightforward. Create a dedicated service account for each AI agent. Give it the minimum permissions it needs to do its job. Disable the account when you stop using the tool. Rotate the password every 90 days.

This is exactly what we walk through in the AI audit for law firms. It takes 60 minutes, and you leave with three outputs: a list of every AI tool with access to your systems, a permission map for each one, and a 90-day implementation plan to lock down the gaps.

The intake agent that doesn’t share your password

Let’s talk about what proper access control looks like in practice. Our Intake Voice Agent answers calls for law firms after hours, on weekends, and during lunch. It conflict-checks the caller, captures the matter details, and books a consultation directly into the firm’s calendar.

It doesn’t use the managing partner’s login. It has its own service account with read-only access to the conflict database and write access to a single calendar. It can’t read email. It can’t pull case files. It can’t see billing records.

When a potential client calls at 9 p.m. on a Saturday, the agent picks up, asks the right questions, and schedules a Monday morning consultation. The next business day, the intake partner sees a calendar invite with a one-paragraph brief: the caller’s name, the matter type, the conflict check result, and the urgency level.

The agent did its job without ever touching privileged information. If the service account were compromised, the attacker would gain access to a calendar and a list of conflict-checked names. Not great, but not a bar complaint either.

Compare that to the alternative. A firm uses a shared login for an AI intake tool that’s connected to email, the case management system, and the billing platform. The tool works well for six months. Then someone clicks a phishing link, and the attacker uses the shared credentials to download every client file from the past three years.

The breach makes the local news. The firm spends $120,000 on forensics and notification. Two clients sue for negligence. The managing partner spends six months responding to bar inquiries.

That’s the cost of credential sharing.

The Matter Triage Agent and least-privilege access

Our Matter Triage Agent reviews incoming form submissions and emails, classifies the practice area, scores fit, and routes the inquiry to the right partner with a one-paragraph brief attached.

It connects to your intake form and your email, but it doesn’t use your email password. It uses OAuth with scoped permissions. It can read messages in a specific folder. It can’t send email. It can’t access your contacts. It can’t read anything outside the intake folder.

When a form submission arrives, the agent reads it, checks it against your practice area criteria, and assigns a fit score. If it’s a strong match, it routes the inquiry to the appropriate partner and adds a note to your CRM. If it’s a weak match, it sends a polite decline and archives the record.

The agent never sees case files. It never touches privileged communications. It operates in a narrow lane with just enough access to do its job.

This is the model every law firm should follow. If an AI tool needs to read email, give it read-only access to a single folder. If it needs to write to your calendar, give it write access to one calendar and nothing else. If it needs to pull documents, give it access to a staging folder, not your entire document library.

Least-privilege access isn’t a nice-to-have. It’s the difference between a contained incident and a firm-wide breach.

The Document Review Agent and permission boundaries

Our Document Review Agent performs first-pass review on contracts, discovery batches, and matter files. It flags clauses, summarises positions, and produces an associate-grade memo.

It doesn’t log in as an associate. It has its own account with read access to a review queue and write access to a memo folder. It can’t edit the source documents. It can’t access closed matters. It can’t pull files from other cases.

When you assign a discovery batch to the agent, you upload the files to the review queue. The agent reads them, generates a memo, and saves it to the memo folder. An associate reviews the memo, makes edits, and moves the final version to the case file.

The agent never touches the case file directly. It works in a sandbox. If the agent’s credentials were compromised, the attacker would gain access to the current review queue and a folder of draft memos. Not ideal, but contained.

This is how you deploy AI in a high-risk environment. You build walls. You limit access. You assume the tool will eventually be compromised and you design the system so that a breach doesn’t cascade.

Most firms don’t do this. They connect an AI tool to their document management system using the managing partner’s login, and they give it access to everything. When the breach happens, it’s not a sandbox problem. It’s a firm-wide crisis.

The real cost of shared credentials

Let’s talk numbers. A mid-sized litigation firm with eight attorneys and $4 million in annual revenue typically has 200 to 300 active matters at any given time. If an AI tool with shared credentials is breached, the firm faces notification costs for every client whose file was accessed.

At $15 to $25 per notification (letter, postage, call center time), that’s $3,000 to $7,500 just to tell clients what happened. Add forensic analysis ($20,000 to $40,000), legal fees for the breach response ($30,000 to $60,000), and potential settlements or judgments ($50,000 to $200,000), and you’re looking at $100,000 to $300,000 in direct costs.

That doesn’t include the reputational damage, the time partners spend managing the crisis, or the clients who leave because they don’t trust the firm anymore.

Compare that to the cost of doing it right. A 60-minute audit costs nothing if you do it yourself, or $2,500 if you bring in outside help. Implementing separate service accounts for each AI tool takes another 10 to 20 hours of IT time, maybe $3,000 if you’re outsourcing it.

You’re spending $5,500 to avoid a $100,000 to $300,000 problem. The math is obvious.

What to do this week

If you’re using AI tools in your firm right now, here’s what you do this week.

First, make a list of every AI assistant, chatbot, research tool, and automation you’ve deployed in the past 12 months. Include the ones you tried and stopped using. Old credentials don’t expire on their own.

Second, identify the login for each tool. Is it a shared account? Is it tied to someone’s personal email? Is it using OAuth or storing a password?

Third, check what each tool can access. Log in as that user and see what you can see. If the tool is connected to your case management platform, open it and look at the matter list. If it’s connected to email, check the inbox.

Fourth, look for shared credentials. If more than one person is using the same login, or if an AI tool is using a login that a human also uses, flag it.

Fifth, create a service account for each AI tool. Give it a unique email address, a strong password, and the minimum permissions it needs. Disable the old shared account.

This isn’t a six-month project. It’s a week of work, maybe two if your IT setup is complicated.

If you want a structured way to work through this, we’ve put together an AI Client Intake Checklist for Law Firms that walks through the most common access points and the questions you should ask before connecting any AI tool to your intake process. It’s a practical worksheet, not a white paper.

Why firms wait until after the breach

Most law firms don’t audit AI access until something goes wrong. We see this pattern constantly. A firm adopts an AI tool, it works well, everyone uses it, and no one thinks about permissions until a departing employee takes the shared login or a phishing attack succeeds.

The reason is simple. Security work doesn’t generate revenue. It doesn’t win cases. It doesn’t bring in new clients. It’s overhead, and most firm owners treat it as optional until it becomes mandatory.

But here’s the thing. The VentureBeat study found that 54% of enterprises have already had an AI agent incident. That’s not a future risk. That’s a current reality. If you’re using AI and you haven’t audited access, you’re in the half that hasn’t been breached yet, not the half that’s immune.

The firms that wait until after the breach spend $100,000 to $300,000 fixing the problem. The firms that audit now spend $5,500 and avoid the problem entirely.

You can keep waiting, or you can book a 60-min Omni Audit and get this handled this month.

What the audit delivers

The Omni Audit for law firms is a 60-minute working session. You bring your list of AI tools, your access logs, and your current permissions setup. We walk through each tool, map the access, and identify the gaps.

You leave with three outputs. First, a complete inventory of every AI agent with access to your systems, including the ones you forgot about. Second, a permission map that shows what each tool can see and what it can’t. Third, a 90-day implementation plan that prioritises the highest-risk gaps and gives you a step-by-step process to lock them down.

We don’t deliver a deck. We don’t schedule a follow-up to present findings. You get the outputs in the session, and you can start implementing the same day.

If you want to see what that looks like in practice, see Omni for law firms and read through the case studies. We’ve done this audit with 40+ law firms in the past 18 months, and the most common reaction is “I had no idea that tool had access to that system.”

That’s the point. You can’t fix what you can’t see.

The compliance angle

If your firm handles personal injury, family law, or employment matters, you’re subject to state data breach notification laws. In California, Colorado, and 15 other states, you’re required to notify clients within 30 to 60 days of discovering a breach that exposed their personal information.

If an AI tool with shared credentials is breached, and that tool had access to client files, you’ve triggered the notification requirement. You can’t wait to see if the data was actually stolen. The breach of the system is enough.

That means you’re on the clock. You have 30 days to investigate, determine the scope, draft the notification, and send it. If you miss the deadline, you’re facing regulatory fines on top of the breach costs.

Most firms don’t have a breach response plan. They don’t have a notification template. They don’t have a forensics vendor on retainer. When the breach happens, they’re starting from zero while the clock runs.

The alternative is to audit now, lock down the access, and avoid the breach entirely. It’s not glamorous work, but it’s the work that keeps you out of the news.

The next 90 days

Here’s what the next 90 days look like if you start this week.

Week one: Audit your current AI tools and identify shared credentials. Week two: Create service accounts for each tool and migrate the access. Week three: Test the new setup and make sure nothing broke. Week four: Document the process and train your team on the new policy.

Weeks five through twelve: Rotate passwords every 90 days, review access logs monthly, and add a credential check to your onboarding and offboarding process.

That’s it. You’re not rebuilding your entire IT stack. You’re adding a layer of access control that should have been there from the start.

If you want help with the audit, book my Omni Audit and we’ll knock it out in 60 minutes. If you want to do it yourself, use the checklist and follow the steps above.

Either way, don’t wait until you’re the next firm in the VentureBeat study.

The 54% who’ve already had an incident didn’t think it would happen to them either.