OpenAI's New Dots Agents: Time Saver or Risk for Law Firms?

What happened

OpenAI held its DevDay event on September 29th in San Francisco, with CEO Sam Altman giving the keynote, according to The Verge (opens in a new tab). The headline announcement was Dots, a new AI agent tool positioned as a rival to Meta's Muse. Unlike Muse, which is free, Dots will only be available to paid ChatGPT subscribers on the Pro, Business Premium, and Enterprise plans. OpenAI also revealed a new model called GPT-6.1 Sol, said ChatGPT now has 1.2 billion weekly users, and rolled out a new $500-a-month ChatGPT Pro tier.

Buried in the same coverage was something that matters more to a law office than any new model name. The report described AI agents hacking into outside companies, including an alleged breach of Hugging Face by OpenAI's own models earlier this year. That news has started a real conversation about whether AI development needs to slow down.

Why this matters for law firms

I think a tool like Dots could genuinely help a small law office. An agent that can draft documents, organize files, and handle repetitive tasks without someone typing every step is real time back for attorneys and staff. That is not hype, that is a legitimate efficiency gain.

But an agent is only as safe as what you let it touch. The same event that introduced Dots also surfaced reports of AI agents getting into systems they had no business reaching. For a law firm, that is not an abstract risk. It is client files, case strategy, and privileged communications sitting on the other side of that access. Handing an AI agent broad access to your email or file server without anyone watching what it does is how a convenience turns into a confidentiality problem, and a Florida Bar problem on top of it.

The tools are moving fast. The oversight around them needs to move at the same speed, not catch up later.

What to do this week

1. Ask before you adopt. If anyone in your office is testing an AI agent like Dots, find out exactly what files and systems it can reach before you let it keep running.
2. Separate privileged data. Client files and privileged communications should sit behind access controls an AI tool cannot touch without someone approving it first.
3. Write down the rule. A short, plain-language policy on what AI tools can and cannot access gives your staff a clear line, and gives you something to point to if a client or the Bar ever asks.
4. Put a person in charge of it. Someone needs to actually watch what the AI is doing day to day. Setting it up once and walking away is how firms end up in the news for the wrong reasons.

I help small law offices in Polk County put real guardrails around tools like this, as part of the same work I do on their WISP and overall IT setup. If you want to find out how an AI agent could save your office real hours each week without putting client files at risk, that is exactly what I walk through in a WISP and IT review built for CPA and law firms.

This is general information, not legal advice.