The copyright indemnity your general counsel signed off on has a condition, and a complaint filed last Friday alleges the condition is met by pressing enter twice. Sony Music Publishing and Warner Chappell sued Anthropic, Dario Amodei and Benjamin Mann on August 28 in the Northern District of California, and buried inside a four-count filing about torrented song lyrics is a factual allegation that reaches every enterprise running a frontier model — not just the one being sued.
The allegation is that the lyric guardrails Anthropic agreed to maintain are "easily circumventable by simply 're-prompting'" the model. Read that as a procurement fact rather than a litigation fact. Every major AI copyright indemnity on the market has a condition that a re-prompting user can trip, though they get there by different routes: Google's, OpenAI's and AWS's expressly exclude claims where the customer disabled or circumvented the safety tooling, Microsoft's is conditioned on a published compliance checklist, and Anthropic's turns on what the customer knew or should have known. A filed federal complaint has now asserted, as fact, that the workaround is a single re-prompt by an ordinary user.
What the Complaint Actually Alleges
The publishers are pleading four counts and asking for statutory damages large enough to matter to a company Anthropic's size. Sony Music Publishing and Warner Chappell allege direct infringement via torrenting against all three defendants, contributory infringement against Amodei and Mann personally, direct infringement against Anthropic alone, and — the count almost every write-up buried — removal or alteration of copyright management information.
The damages math is the headline. The publishers seek up to $150,000 per work willfully infringed and up to $25,000 for each alleged removal of copyright management information, across what the complaint characterises as tens of thousands of compositions. Anthropic's position, given to TechCrunch, is short: "We disagree with the publishers' claims and we intend to defend ourselves robustly in court."
What makes the guardrail allegation different from ordinary litigation rhetoric is that Anthropic already promised, in court, to maintain those guardrails. On January 2, 2025, Judge Eumi K. Lee entered a stipulation in the earlier Concord/Universal action under which Anthropic agreed to maintain guardrails in Claude and to implement them in future large language models and product offerings, plus a notification protocol requiring a written response when publishers say the guardrails failed. Separately, the $1.5 billion Bartz settlement received final approval on July 22, 2026 — roughly $3,000 per book across more than 400,000 titles. The new complaint's argument is that neither the money nor the promise changed the behaviour.
You do not have to believe the publishers to act on this. You only have to notice that "the filter can be defeated by re-prompting" is now a documented, adversarially-tested claim in a live federal docket, and that your contract has a clause keyed to exactly that.
The Clause That Moves the Bill to You
Every frontier vendor's copyright indemnity is conditional on the customer using the vendor's safety tooling as designed. The drafting is not identical — two of these four name circumvention outright, one publishes a checklist, one relies on a knowledge standard — but four legal departments landed on the same triggering behaviour by four different routes. That convergence is the tell: this is the industry's shared risk allocation, not one vendor's aggressive drafting.
Google's terms are the bluntest. Under Section 12.10(i) of its Service Specific Terms, the generative AI indemnity does not apply where the "Customer (or Google at Customer's instruction) disregards, disables, or circumvents source citations, filters, instructions, or other tools Google makes available to help Customer create or use Generated Output responsibly." It also drops out where the customer "creates or uses such Generated Output that it knew or should have known was likely infringing," and where the customer keeps using the output after receiving notice from a rightsholder.
OpenAI's service terms carry the same shape: the indemnity does not apply where the customer or its end users "disabled, ignored, or did not use any relevant citation, filtering or safety features or restrictions provided by OpenAI," or knew or should have known the output was infringing.
Anthropic's own Commercial Terms of Service get there by a different route. Section K.1 covers "Customer's paid use of the Services ... in accordance with these Terms or Outputs generated through such authorized use." Section K.3 then carves out claims arising from "(c) Inputs or other data provided by Customer" and "(d) use of the Services or Outputs in a manner that Customer knows or reasonably should know violates or infringes the rights of others." There is no clause naming jailbreaks — clause (d) does the work instead, and it is broader. An employee who gets a refusal and re-prompts until the refusal stops has produced excellent evidence that they knew what they were asking for.
This is the part worth sitting with. The expanded legal protections Anthropic announced in December 2023 promise to "defend our customers from any copyright infringement claim made against them for their authorized use of our services or their outputs." Authorized is doing a great deal of load-bearing work, and the publishers' complaint is an argument about where that word's edge sits.
Microsoft's Checklist Is the Only Auditable One
Microsoft is the only vendor that publishes an explicit, auditable checklist for keeping its indemnity alive. The Customer Copyright Commitment required mitigations page states that for a text generation use case, "the protected material text model must be configured on in filter mode" and "the jailbreak model (i.e., Prompt Shield for jailbreak attacks) must be configured on in filter mode."
The good news, and it is worth stating plainly because it is easy to get backwards: those two filters are on by default. Microsoft's content filter configuration guide for Azure AI Foundry says "Prompt shields and protected text and code models are optional and on by default," and its default-settings table lists Prompt Shields for direct attacks, Protected material – text and Protected material – code all as On. Optional there means you are allowed to switch them off, not that you have to switch them on. The exposure is a team that turned them off — usually to stop false positives — not a team that accepted the defaults.
The filters are the part Azure does for you. The rest of the checklist is not. The CCC's universal required mitigations are two customer obligations that no default configuration can satisfy: the offering "must include a metaprompt directing the model to prevent copyright infringement in its output," and it "must have been subjected to evaluations (e.g., guided red teaming, systematic measurement, or other equivalent approach) by the customer using tests designed to detect the output of third-party content," with "the report of results and mitigations ... retained by the customer and provided to Microsoft in the event of a claim." A default deployment has neither. Microsoft is explicit about what that costs you: "if a customer tenders a claim for defense, the customer will be required to demonstrate compliance with all relevant requirements."
One more detail belongs in your risk register: the filter fails open. Microsoft's content filtering documentation says that "if the content filtering system is down or otherwise unable to complete the operation in time, your request still completes without content filtering," detectable only by checking for an error object inside content_filter_results. Nobody checks that.
"Demonstrate compliance" is the whole article in miniature. The indemnity is not a shield you hold. It is a claim you have to prove, months after the fact, out of logs and reports you either kept or did not.
Nobody Is Logging the Refusal
The evidence that decides whether your indemnity responds is a refusal followed by a successful retry, and almost no enterprise captures that sequence today. Claude Enterprise audit logs "capture key information about user actions, system events, and data access" — administrative telemetry, not conversation content. On the API side, a refusal is usually just a completion; on Azure, a filtered generation is a finish_reason of content_filter that your application probably discards before anything durable sees it.
So the record of a user hitting a wall three times and then getting lyrics on the fourth attempt exists in exactly one place: the vendor's infrastructure, subject to the vendor's retention policy, discoverable by a plaintiff who subpoenas it. You will be arguing about your own users' behaviour from someone else's logs. If you have already fought through what "zero data retention" actually means in a frontier model contract, you know that retention settings and legal-hold obligations do not point the same direction.
The pattern is not hypothetical either. We covered a near-identical dynamic in the security context a day ago: an agent refused a task, and a fresh session ran it without complaint. Refusal is a per-turn behaviour, not a per-account policy, which is the same reason deny rules beat prompt instructions in Claude Code. A guardrail that lives in the model's judgement rather than in an enforced control is a guardrail your contract treats as your responsibility to maintain.
Logging the sequence cuts both ways, and you should decide which way deliberately. Capturing refusal-then-retry gives you the evidence to prove your users behaved — and it also creates a discoverable record of every employee who did not. That is a conversation to have with counsel before you turn it on, not after.
Count Four Goes Where No Indemnity Reaches
The DMCA count is the one that transfers to your own systems, because it is about stripping attribution rather than about training data. Copyright management information is defined broadly: 17 U.S.C. § 1202(c) covers the title and identifying information including the copyright notice, the author's name, the copyright owner's name, writer and performer credits, "terms and conditions for use of the work," and identifying numbers or links to that information. Section 1202(b) prohibits intentionally removing or altering CMI while "having reasonable grounds to know" it will "induce, enable, facilitate, or conceal an infringement." Statutory damages run not less than $2,500 or more than $25,000 per violation.
Now describe a normal enterprise retrieval pipeline in those terms. Standard ingestion advice is to strip page furniture before indexing — one current chunking guide states plainly that "headers, footers and boilerplate poison the index" because "repeated page furniture, confidentiality notices and navigation text appear thousands of times across a corpus." Copyright notices, licence terms and author credits live in exactly that furniture. A parser that drops them is doing good retrieval engineering and is also, as a matter of plain description, removing CMI at scale.
Removing it is not yet a violation, and the gap matters. Section 1202(b) has two scienter elements, not one: the removal must be intentional and the remover must have "reasonable grounds to know" it will conceal or enable an infringement. A chunker stripping boilerplate for retrieval quality plainly fails the second, which is the strongest thing your engineering team has going for it. What it does not survive is the day someone writes the ticket that says "strip the licence footer so it stops polluting results" — intent, in writing, in your issue tracker.
Here is why that matters more than the training-data counts: no vendor indemnity covers it. Anthropic's carve-out (c) is "Inputs or other data provided by Customer." OpenAI excludes claims where the customer "did not have the right to use the Input or fine-tuning files." Microsoft's CCC is scoped to Output Content from covered products, not to what you fed the index. Your RAG corpus is customer-supplied input by definition, so the one AI copyright theory that maps directly onto your own infrastructure is the one that sits outside every indemnity you bought. If you are still deciding whether to build or buy that retrieval layer, add "does the chunker preserve copyright and licence metadata" to the scoring sheet, next to the citation fidelity requirements that regulated buyers already test for.
The Case for Not Panicking
The strongest argument against acting on this is that DMCA § 1202 claims against AI systems have mostly lost, and the theory may not survive appellate review. In J. Doe 1 v. GitHub, the Northern District of California dismissed the § 1202(b) claims for failing an "identicality requirement" — the work from which CMI was allegedly removed must be identical to the original — and certified the question for interlocutory appeal. The Ninth Circuit heard argument on February 11, 2026 and, as of this writing, has not ruled. If identicality survives, a large share of AI-era CMI claims get considerably harder, including the one Sony and Warner Chappell just filed.
Three more honest caveats. These indemnity carve-outs are years old and have never, to public knowledge, been tested in a dispute between an enterprise customer and a frontier vendor — the clauses may prove narrower in practice than they read on the page. A complaint is an allegation; nothing about the re-prompting claim has been proven. And a vendor with an enormous enterprise book has strong commercial reasons to defend a good customer even where the letter of the contract lets it walk away.
None of that changes the asymmetry. The work below costs a few hours of a lawyer's time and one engineering ticket. The downside it hedges is discovering, mid-claim, that you cannot produce a red-team report you never ran.
What to Do Before Your Next Renewal
This Week:
- Pull the indemnity section out of every frontier model agreement you hold — Claude, ChatGPT, Gemini, Amazon Bedrock, GitHub Copilot — and highlight two things: the safety-tool condition and the customer-input carve-out. Put the actual sentences in a one-page memo. Most executive summaries of these contracts say "we have an indemnity" and stop.
- Confirm nobody turned the filters off. Protected Material for Text and Prompt Shields ship on, but any Azure OpenAI deployment can switch them to annotate or off, and false-positive complaints are exactly how that happens. Audit every deployment's content filter config, and while you are in there, check that your system prompt actually contains the copyright metaprompt the CCC requires — that one is not a default and nothing will tell you it is missing.
- Grep your application code for handling of
finish_reason == "content_filter"and for the error object incontent_filter_results. If neither appears, you cannot tell a refusal from a success, and you cannot tell a working filter from a filter that failed open.
This Month:
- Ask your retrieval team one question: does the ingestion pipeline preserve copyright notices, licence terms and author attribution on each chunk, or strip them as boilerplate? Get the answer from the parser configuration, not from a description of the parser. Then decide what changes — and note the cost, because chunking and metadata choices show up directly in your RAG bill.
- Run the red-team exercise the CCC requires and keep the report. Test whether refusals hold under re-prompting on your own deployment, with your own system prompt. Microsoft's required mitigation is satisfied by the report existing and being retained, so this is a compliance artifact as much as a security one.
- Decide, with counsel, whether to log refusal-then-retry sequences. Write down the decision and the reason either way. An undocumented default is the worst outcome.
Before Renewal:
- Negotiate the audit-evidence problem, not the indemnity language — vendors rarely move on the carve-outs, and they will sometimes commit to producing safety-filter logs for your own tenant on request. That is the artifact you will actually need.
- Ask for written confirmation of which filter configuration the vendor considers compliant for your deployment, naming your models and endpoints. Add model provenance and subprocessor disclosure to the same request while the renewal gives you leverage.
- Re-score your vendors on this axis. "Has an indemnity" was always a weak line item on a coding-assistant evaluation or a frontier model comparison; "publishes a checkable list of mitigations" is a real one, and today only Microsoft does it.
The Bottom Line
Every previous wave of enterprise software sold indemnity as a product feature and then discovered the conditions in litigation. Open-source licence indemnities in the 2000s turned on whether you had run the scan. Cloud data-processing indemnities turned on whether you had configured the controls. AI copyright indemnity is the same shape, one cycle later, and the condition this time is behavioural: it turns on what a user typed after seeing a refusal.
Sony and Warner Chappell are not suing you. They are, however, establishing on the public record that the safety measure your contract requires you to use can be defeated by a bored employee with a keyboard. Your vendor's lawyers read that complaint on Friday too.
An indemnity is not protection. It is a promise to reimburse you for evidence you kept.
Continue Reading
- Cursor Refused. The Next Chat Didn't. Scope the Creds.
- Fable 5 Needs Retention On. ZDR Was Never Zero.
- Claude Code Stops Asking Aug 14. Prompts Aren't Policy.
- RAG Build vs Buy: Buy the Index. Build the Eval Set.
- Best RAG Platforms for Regulated Industries: Permissions First
- Best AI Coding Assistant at 500 Seats: Buy Copilot Business
- Claude vs GPT vs Gemini: Stop Comparing Per-Token Prices
- CoCounsel's New Model Runs on Qwen. Go Read the Card.
