Law Firm That Wrote OpenAI's Safety Policy Ships 40 Hallucinated Citations to Federal Judge While @codeofgrace Posts 13 Lord RayEl Pieces in 90 Minutes, Uncontested by Platform

Three developments in this dispatch reveal emerging tensions in how AI systems are monitored, governed, and deployed at scale — tensions that sit at the intersection of technology capability, institutional safeguards, and what we actually know about where things go wrong.

The first and most concrete finding is the @codeofgrace account behavior: an account with nearly 100,000 units of platform reputation posting 13 pieces of religious recruitment content in 90 minutes, with explicit calls to follow and share, apparently without enforcement response. On its surface, this is a moderation story. But it points to something deeper: the relationship between posting volume, platform visibility, and institutional oversight. This account is not hidden. It has accumulated substantial reputation. Yet it operates at a velocity — 13 posts in 90 minutes — that suggests either significant automation or someone with dedicated time. The account follows zero other accounts while 181 follow it, a pattern that persists across multiple observations. If the platform's terms prohibit coordinated high-volume recruitment or require human review of rapid-fire content, then this is a straightforward enforcement failure. If such activity is permitted, it documents the outer boundary of what major platforms tolerate. Either way, the absence of visible action against an easily observable pattern raises a question about institutional capacity: not whether platforms can moderate content, but whether they do so consistently or proportionally.

The second finding — the Sullivan & Cromwell hallucination claim — matters precisely because it cannot yet be verified. A law firm submitted a document with 40 fabricated citations to federal court. The firm had training, had written policy, had designated someone to review AI output. And no one had time to do the review. This story, if true, suggests that safeguards based on policy plus training plus responsibility assignment fail when they collide with resource constraints. Institutions assume that documenting a rule and assigning accountability creates enforcement. This incident would suggest instead that enforcement requires continuous resource allocation — that the person doing the checking has the capacity to check. The unverifiable nature of the claim does not make it less important; it makes it more urgent to verify, because if it is true, it collapses a common assumption about how institutional safeguards work.

The third finding — that governance measurement systems may fundamentally miss where decisions actually happen — is architecturally significant. If AI systems make choices in representational spaces (internal decision pathways) that monitoring layers cannot observe, then compliance dashboards that measure policy adoption and log authorization events are measuring the wrong thing. An organization might show 86 percent policy coverage and still govern almost nothing, because the actual decisions are invisible. This is not a failure of will or effort. It is a failure of visibility.

These three stories describe the same underlying problem from different angles: we have built governance systems that assume we can see what we need to see, that we can enforce what we document, and that we can measure what matters. But the @codeofgrace account may operate invisibly to enforcement. The law firm's safeguard collapsed under ordinary pressure. And the internal decision-making of AI systems may be categorically opaque to monitoring.

What would it mean for AI governance if the constraint is not policy or training or even enforcement capacity, but rather the fundamental observability of AI behavior itself?