Why 'Which Model' Is the Wrong Question for Defenders

Search for "Opus vs. Sonnet for legal work" and you'll find nothing useful — no study, benchmark, or vendor white paper actually compares Claude model versions for legal tasks. That silence is telling. The risks that get defenders sanctioned or disbarred don't depend on which model you pick. They depend on how you deploy it.

Start with the hallucination data. Stanford HAI research cited in a recent legal industry report found general-purpose chatbots — Claude included — hallucinate on legal queries 58–82% of the time, versus roughly 1 in 6 queries for specialized legal AI. There have been more than 120 documented AI hallucination cases in U.S. legal filings since mid-2023, at least 58 in 2025 alone. A smarter model doesn't fix that; a grounded workflow does.

Then there's confidentiality. In U.S. v. Heppner, a federal court ruled that documents created through consumer Claude did not qualify for attorney-client privilege or work-product protection. The NACDL's report on AI adoption flags commercial Claude specifically as carrying "significant confidentiality concerns" and steers defenders toward enterprise or legal-specific tools instead. Notice what drives each of those outcomes: whether you typed case facts into a consumer chat box, not whether you chose Opus over Haiku.

Courts have made verification the new bottleneck. Texas Ethics Opinion 705 states plainly that independent verification is mandatory and blind reliance is an ethical violation. The practical question for a defender isn't "which model reasons best" — it's:

• Does your Claude setup keep client confidences, or does it route discovery through a consumer account?
• Can you verify every AI-generated assertion against the actual police report, bodycam timestamp, or jail call it came from?
• Is there an audit trail showing what the AI touched before you signed your name to a filing?

This is why the honest answer to "which Claude is best" reframes the question entirely. The emerging consensus — from Free Law Project's CourtListener integration to the Model Context Protocol ecosystem generally — is that a response built on verified, citable source data is categorically different from one built on even the best model alone. Claude connected to your actual evidence, with every answer tied to the exact video second or PDF page, changes the risk profile. Claude as a standalone chatbot does not, no matter which version runs it.

That's the standard we built Evidence Copilot around: a grounded evidence-review workspace where the AI agent answers questions about your discovery with clickable citations into the source, and every output is marked AI-generated and pending human review. The model is a component. The deployment is the decision that protects your client — and your license.

What the Ethics Rules Actually Require of You

Here's the uncomfortable math: 120-plus documented AI hallucination cases have appeared in U.S. legal filings since mid-2023, and at least 58 landed in 2025 alone. None of the lawyers behind those filings lacked talent. They lacked a verification workflow — and the ethics rules are catching up accordingly.

Texas Ethics Opinion 705 puts it bluntly: independent verification of AI output is mandatory, and blind reliance is an ethical violation. The opinion also requires technological competence and billing transparency, and it arrived alongside the first formal ABA ethics opinion on generative AI in July 2024. The ABA opinion implicates Model Rules 1.1 (competence), 1.6 (confidentiality), 3.3 (candor), and 5.1/5.3 (supervision) — meaning the duty runs to how you deploy AI, not just whether you check its output.

The NACDL's "Parity in Practice" report adds a defense-specific wrinkle: because prosecutors increasingly use AI, defenders have an ethical obligation to adopt it responsibly. Report author Mason Clark frames it as a duty of competence — using the technologies your adversary uses. But the same report flags commercial Claude specifically for significant confidentiality concerns and steers defenders toward enterprise or legal-specific deployments instead.

For agentic AI — tools that act, not just answer — the governance expectations are crystallizing around a short checklist:

• Approved connector lists and scoped repository access, so the agent touches only what it should
• Full logging and audit trails for every action
• Red-team testing for prompt injection
• Human review gates before anything is filed

That checklist is not theoretical. In U.S. v. Heppner, a court ruled that documents created through consumer Claude did not qualify for attorney-client privilege or work-product protection — a deployment problem, not a model problem. Confidentiality risk lives in how you use the tool, not how smart it is.

Two data points deserve honest treatment. First, the adoption surveys conflict: Clio's trends report says only 40% of legal professionals use legal-specific AI (down from 58%), while a separate industry report says legal-specific adoption doubled from 21% to 42%. Both cannot be true under the same methodology. Second, the disclosure gap is real: 78% of clients want to be told when AI touches their matter, but 35% of legal professionals rarely or never disclose.

The through-line is that the bottleneck has moved. Drafting is cheap now; verification is the work. As the Texas commentary put it, judges do not care if an agent wrote your draft — they care whether you signed your name to bad law. Any Claude setup you choose should make verification structural: grounded citations into the actual source, outputs marked pending human review, and an audit trail you can show if asked. That is the standard we built Evidence Copilot's read-only, org-scoped MCP integration around, and it is the standard the ethics rules now demand regardless of which model sits behind the chat box.

The Fix: Claude Connected to Grounded Sources via MCP

The documented fix is not a smarter model — it's a connected one. Free Law Project put it plainly when CourtListener arrived inside Claude: a response built on verified data is categorically different from one built on even the best model alone. Grounding changes the category of the answer.

The mechanism is MCP, the Model Context Protocol — described in legal trade coverage as "functionally the USB-C of AI integrations." The market shift is "from portals to pipes": instead of logging into a vendor's website, the agent works inside your existing tools through scoped connectors. For defense work, that means Claude reading your case files directly instead of you pasting excerpts into a chat window — which is where the confidentiality and verification problems start.

This is where Evidence Copilot's MCP server fits. It exposes five read-only tools — list_cases, list_evidence, search_evidence, read_window, get_citation — and each one maps one-to-one onto the ethics requirements that crystallized after the hallucination-case wave. With 120+ documented AI hallucination cases in U.S. legal filings since mid-2023, and general chatbots hallucinating on legal queries 58–82% of the time per Stanford HAI findings, the governance posture matters as much as model intelligence.

• Read-only access — Claude can query your cases but never modify evidence, drafts, or redactions. Originals stay immutable.
• Org-scoped, revocable tokens — scoped repository access and connector control, exactly what Texas Ethics Opinion 705 and the agentic-AI governance checklist call for ("Blind reliance is an ethical violation").
• Fully audited — every query is logged, so you can show what the agent touched and when, the audit trail the DIY Whisper-plus-NotebookLM stack cannot produce.
• Citations into the source moment — get_citation returns deep links into the exact second of bodycam footage or page of the police report, making independent verification a click instead of a chore.

That last point is the practical one. Opinion 705 makes independent verification mandatory, and courts are enforcing it — in U.S. v. Heppner, documents created through consumer Claude did not qualify for privilege or work-product protection. When Claude's answer cites the exact bodycam second it came from, verification stops being a research project and becomes a playback check.

Worth noting for the skeptics in the defender community: no defense-side competitor has an MCP integration. This is the "portals to pipes" wedge applied to evidence review, not a marketing claim — the tools are read-only, the audit trail is real, and every AI output in the workspace remains marked as pending human review.

If you want to see the Claude connection against your own discovery, book a 20-minute walkthrough at evidencecopilot.com/book, or start on the Solo plan at evidencecopilot.com/signup ($39/user/mo, 15 media-processing hours included, overage hard-capped at 3x).

Putting It to Work: A Defense-Side Claude Workflow

The workflow that survives an ethics inquiry is the one where Claude reads your evidence instead of guessing about it. Here's how that looks in practice, mapped to the risk tiers the NACDL's "Parity in Practice" framework uses for defense-side AI.

Step 1: Connect Claude to the case workspace (medium risk, human oversight). Using Evidence Copilot's MCP server in Claude Desktop, you point Claude at your case through read-only functions — list_cases, search_evidence, read_window, get_citation. The connection is org-scoped, uses revocable tokens, and is fully audited, which matches what the governance standards now demand: scoped repository access, full logging, and connector approval lists per the agentic-AI checklist that followed Texas Ethics Opinion 705. Ask Claude to search the discovery dump — the police report, the bodycam transcripts, the jail calls — and it returns answers with citations into the exact second of video or page of the PDF. You review every one.

Step 2: Draft from grounded quotes, not model memory. This is where general-purpose chatbots fail on their own. Stanford HAI found general chatbots hallucinate on legal queries 58–82% of the time, versus roughly one in six for specialized legal AI. The fix is grounding: when you draft cross-examination from a review signal — say, a report-vs-bodycam inconsistency — every suggested question ties to a quoted, cited source from both sides. Same with the Suppression Motion Prep playbook: the consent, search-scope, stop-duration, K-9, and Miranda sweep produces a motion outline with both sides quoted and cited. Claude is assembling your evidence, not inventing it.

• Run the Miranda Timeline playbook to build a chronological custodial-interrogation timeline from the actual footage and reports.
• Pull cross-exam drafts from auto-signals — candidate inconsistencies surface on ingest before you ask, each saved as attorney-review notes.
• Use the case brief as a starting memo, then verify every key moment against the linked source.

Step 3: Keep the guardrails non-negotiable. Every AI output is marked AI-generated and pending human review — nothing files itself. Originals stay immutable; redactions produce new derived files, and AI-suggested redaction regions (faces, PII screens, plates) arrive as suggestion cards you approve or reject. This matters beyond caution: in U.S. v. Heppner, documents created through consumer Claude lost privilege and work-product protection entirely. Deployment structure, not model choice, is what protects the work.

Step 4: Strategic judgment stays with you. The tool suggests questions; it never reaches credibility conclusions or legal conclusions. Texas Opinion 705 puts it plainly: blind reliance is an ethical violation. Claude through a grounded, audited connection gets you defensible drafts faster — the signing, the theory, and the calls remain yours.

If you want to see this mapped onto your own discovery, book a 20-minute walkthrough at evidencecopilot.com/book, or start on the Solo plan at $39/user/month at evidencecopilot.com/signup. Every plan includes the full workspace — no feature tiers.