The decision also flagged a broader risk: Sharing otherwise privileged information with a consumer AI tool may waive the privilege over those underlying communications.
In an issue of first impression, a federal court held that information a defendant input to a consumer generative AI system on his own initiative is not protected by the attorney-client privilege or the work product doctrine. That holding extended to documents the defendant generated using AI and later shared with counsel.
In United States v. Heppner, No. 25 CR. 503 (JSR), 2026 WL 436479 (S.D.N.Y. Feb. 17, 2026), the court addressed whether a defendant’s conversations with a consumer generative AI platform are privileged. Judge Jed S. Rakoff held they are not—where the conversations were not made at counsel’s request and were conducted on a publicly available, nonenterprise platform. This is the first federal court decision to address whether a client’s “AI chats” on a consumer AI platform are privileged. The answer, on these facts, is no. The decision also flagged a broader risk: Sharing otherwise privileged information with a consumer AI tool may waive the privilege over those underlying communications.
The Case: United States v. Heppner
Bradley Heppner, former CEO of a financial services company, was charged with securities fraud, wire fraud, conspiracy, making false statements to auditors and falsification of records.[1] After receiving a grand jury subpoena and learning he was a target—but before his arrest—Heppner used Anthropic’s consumer Claude AI tool. Acting on his own, not at counsel’s direction, he used the tool to generate documents analyzing his legal exposure and defense strategy. Heppner, 2026 WL 436479, at *1–2. He inputted information received from his defense counsel into the prompts and then shared the AI-generated outputs with his lawyers. Id. at *2.
When FBI agents arrested Heppner and executed a search warrant, they seized electronic devices containing the AI-generated documents. Id. at *1. Defense counsel asserted attorney-client privilege and work product protection. Id. at *2. The government moved for a ruling that the documents were neither privileged nor work product.[2]
Judge Rakoff ruled in the government’s favor, rejecting Heppner’s privilege and work product claims. The court’s analysis addressed three areas:
Attorney-Client Privilege
Attorney-client privilege protects confidential communications between a client and a licensed professional who owes fiduciary duties and is subject to professional discipline.[3] The court held that Anthropic’s Claude is none of those things. It holds no law license, owes no duty of loyalty and cannot form an attorney-client relationship. The court observed that all recognized privileges require “a trusting human relationship”—and no such relationship “exists, or could exist, between an AI user and a platform such as Claude.” Heppner, 2026 WL 436479, at *2. Anthropic’s own terms disclaim providing legal advice, and when asked directly, Claude responds: “I’m not a lawyer and can’t provide formal legal advice or recommendations.” Id. at *3.
The court further found no reasonable expectation of confidentiality. Anthropic’s privacy policy tells users it collects their “inputs” and “outputs” and uses that data to “train” Claude. The policy also reserves the right to disclose user data to “third parties,” including “governmental regulatory authorities.”[4] The court concluded that Heppner “could have had no ‘reasonable expectation of confidentiality in his communications’ with Claude.”[5]
Work Product Doctrine
The work product doctrine “provides qualified protection for materials prepared by or at the behest of counsel in anticipation of litigation or for trial.”[6] Here, defense counsel conceded that the AI documents “were prepared by the defendant on his own volition” and confirmed that the legal team “did not direct” Heppner to use the AI tool. Heppner, 2026 WL 436479, at *2–3. Without attorney direction, the court held that work product protection does not attach.[7] The court stressed that documents that “would not be privileged if they remained in [Heppner’s] hands” did not “acquire protection merely because they were transferred” to counsel.[8]
Privilege Waiver
Heppner also input information he had received from his attorneys into the AI tool. The court noted in a footnote that “even if certain information that Heppner input into Claude was privileged, he waived the privilege by sharing that information with Claude and Anthropic, just as if he had shared it with any other third party.” Heppner, 2026 WL 436479, at *3 n.3. This aspect of the decision may carry the broadest practical implications: It suggests that inputting privileged materials into a consumer AI tool could waive the privilege over the underlying communications themselves.
What This Means for Companies and Counsel
Companies and their counsel should consider the following:
Avoid AI Exposure of Sensitive Information
Advise clients and employees not to upload attorney-client privileged information or confidential work product into any consumer AI tool. Consumer AI tools include the free and individual paid tiers of Claude, ChatGPT, Google Gemini, Microsoft Copilot and Grok.
Review and Update AI Usage Policies
Audit your organization’s policies governing employee use of AI tools. Establish formal protocols governing AI use in investigations, litigation preparation and any context involving sensitive legal information.
Structure AI Use Under Counsel’s Direction
The court left open that counsel-directed AI use on a secure enterprise platform—with contractual confidentiality terms—could yield a different result.[9]
Scrutinize AI Platform Terms
Before deploying any AI tool for legal work, review the platform's terms of service and privacy policy—particularly provisions covering data collection, model training and third-party disclosure.
For More Information
If you have any questions about this Alert, please contact Courtney L. Baird, Ryan S. Crawford, any of the attorneys in our Trial Practice Group or the attorney in the firm with whom you are regularly in contact.
Notes
[1] Redacted Indictment, Heppner, No. 25 CR. 503 (JSR) (S.D.N.Y. Oct. 28, 2025) (ECF No. 3); see also Heppner, 2026 WL 436479, at *1.
[2] Motion for a Ruling that Documents the Defendant Generated Through an Artificial Intelligence Tool Are Not Privileged at 3–4, 7–8, Heppner, No. 25 CR. 503 (JSR) (S.D.N.Y. Feb. 6, 2026) (ECF No. 22); see also Heppner, 2026 WL 436479, at *2.
[3] United States v. Mejia, 655 F.3d 126, 132 (2d Cir. 2011) (setting forth the elements of attorney-client privilege in the Second Circuit); see Heppner, 2026 WL 436479, at *2.
[4] Id. at *2–3 (discussing Anthropic’s privacy policy); see also Anthropic, Privacy Policy (as of Feb. 19, 2025).
[5] Id. at *2–3 (finding that the AI documents were not communications between Heppner and counsel, that no reasonable expectation of confidentiality existed under Anthropic’s privacy policy, and that Heppner did not communicate with Claude for the purpose of obtaining legal advice).
[6] In re Grand Jury Subpoenas Dated Mar. 19, 2002, and Aug. 2, 2002, 318 F.3d 379, 383 (2d Cir. 2003); see Heppner, 2026 WL 436479, at *3.
[7] Id. at *3–4 (holding that the work product doctrine did not apply because Heppner created the AI documents independently and not at counsel’s direction); see also In re Grand Jury Subpoenas Dated Mar. 19, 2002, and Aug. 2, 2002, 318 F.3d 379, 383 (2d Cir. 2003).
[8] Id. at *3 (quoting Gould, Inc. v. Mitsui Min. & Smelting Co., Ltd., 825 F.2d 676, 679–80 (2d Cir. 1987) (holding that preexisting, non-privileged materials do not acquire protection merely because they were transferred to counsel)).
[9] See Heppner, 2026 WL 436479, at *3 (noting that had “counsel directed Heppner to use Claude, Claude might arguably be said to have functioned in a manner akin to a highly trained professional who may act as a lawyer’s agent within the protection of the attorney-client privilege”).
Disclaimer: This Alert has been prepared and published for informational purposes only and is not offered, nor should be construed, as legal advice. For more information, please see the firm's full disclaimer.