Defendant's Own AI Legal Research Isn't Protected by Attorney-Client Privilege

"Because Claude is not an attorney, that alone disposes of Heppner's claim of privilege."

From U.S. v. Heppner, handed down today by Judge Jed Rakoff (S.D.N.Y.):

At a pretrial conference in this matter held on February 10, 2026, the Court … granted from the bench the Government's motion for a ruling that certain written exchanges that defendant Benjamin Heppner had with a generative artificial intelligence ("AI") platform were not protected from Government inspection by either the attorney-client privilege or the work product doctrine. This Memorandum sets forth the reasons for the Court's ruling….

[T]he indictment charges that Heppner defrauded [GWG Holdings'] investors out of more than $150 million by making false representations about, and causing GWG to enter into undisclosed self-serving transactions concerning, two privately held companies that Heppner controlled, Beneficient Company Group, L.P. and Highland Consolidated L.P.

In connection with Heppner's arrest on November 4, 2025, agents with the Federal Bureau of Investigation executed a search warrant at Heppner's home and seized numerous documents and electronic devices. Heppner's counsel later represented to the Government that among the seized materials were approximately thirty-one documents that memorialize communications that Heppner had with the generative AI platform "Claude," which is operated by the private company Anthropic.

According to Heppner's counsel, the documents represent communications between Heppner and Claude that took place "in 2025, after Mr. Heppner had received a grand jury subpoena [and] after it was clear with discussions with the government that Mr. Heppner was the target of this investigation." Without any suggestion from counsel that he do so, Heppner "prepared reports that outlined defense strategy, that outlined what he might argue with respect to the facts and the law that we anticipated that the government might be charging." Thus, counsel asserted, Heppner "was preparing these reports in anticipation of a potential indictment."

In exchanges with the Government, Heppner, through his counsel, asserted privilege over these documents (the "AI Documents"), arguing that (1) Heppner had inputted into Claude, among other things, information that Heppner had learned from counsel; (2) Heppner had created the AI Documents for the purpose of speaking with counsel to obtain legal advice; and (3) Heppner had subsequently shared the contents of the AI Documents with counsel. Heppner's counsel conceded, however, that counsel "did not direct [Heppner] to run Claude searches." …

It is well established that the attorney-client privilege attaches to, and protects from disclosure, "communications (1) between a client and his or her attorney (2) that are intended to be, and in fact were, kept confidential (3) for the purpose of obtaining or providing legal advice." Courts construe the attorney-client privilege narrowly because it operates as an exception to the rule that "all relevant proof is essential" for a complete record and for "confidence in the fair administration of justice."

Applying these principles here, the AI Documents lack at least two, if not all three, elements of the attorney-client privilege. First, the AI Documents are not communications between Heppner and his counsel. Heppner does not, and indeed could not, maintain that Claude is an attorney. "In the absence of an attorney-client relationship, the discussion of legal issues between two non-attorneys is not protected by attorney-client privilege." Because Claude is not an attorney, that alone disposes of Heppner's claim of privilege.

The Court is aware that some commentators have argued that whether Claude is an attorney is irrelevant because a user's AI inputs, rather than being communications, are more akin to the use of other Internet-based software, such as cloud-based word processing applications. But the use of such applications is not intrinsically privileged in any case, and the argument that Claude is like any other form of software only cuts against the invocation of privilege because all "[r]ecognized privileges" require, among other things, "a trusting human relationship," such as, in the attorney-client context, a relationship "with a licensed professional who owes fiduciary duties and is subject to discipline." No such relationship exists, or could exist, between an AI user and a platform such as Claude.

Second, the communications memorialized in the AI Documents were not confidential. This is not merely because Heppner communicated with a third-party AI platform but also because the written privacy policy to which users of Claude consent provides that Anthropic collects data on both users'"inputs" and Claude's "outputs," that it uses such data to "train" Claude, and that Anthropic reserves the right to disclose such data to a host of "third parties," including "governmental regulatory authorities." The policy clearly puts Claude's users on notice that Anthropic, even in the absence of a subpoena compelling it to do so, may "disclose personal data to third parties in connection with claims, disputes[,] or litigation." More generally, as another court in this District recently observed, AI users do not have substantial privacy interests in their "conversations with [another publicly accessible AI platform] which users voluntarily disclosed" to the platform and which the platform "retains in the normal course of its business." For these reasons, Heppner could have had no "reasonable expectation of confidentiality in his communications" with Claude. And the AI Documents are not like confidential notes that a client prepares with the intent of sharing them with an attorney because Heppner first shared the equivalent of his notes with a third-party, Claude.

Third, Heppner did not communicate with Claude for the purpose of obtaining legal advice. This issue perhaps presents a closer call because Heppner's counsel asserts that Heppner communicated with Claude for the "express purpose of talking to counsel." But, as Heppner's counsel also conceded, Heppner did not do so at the suggestion or direction of counsel.

Had counsel directed Heppner to use Claude, Claude might arguably be said to have functioned in a manner akin to a highly trained professional who may act as a lawyer's agent within the protection of the attorney-client privilege. But because Heppner communicated with Claude of his own volition, what matters for the attorney-client privilege is whether Heppner intended to obtain legal advice from Claude, not whether he later shared Claude's outputs with counsel. And Claude disclaims providing legal advice. Indeed, when the Government asked Claude whether it could give legal advice, it responded that "I'm not a lawyer and can't provide formal legal advice or recommendations" and went on to recommend that a user "should consult with a qualified attorney who can properly assess your specific circumstances."

Thus, the communications between Heppner and Claude were not privileged at the time they took place. Moreover, even assuming that Heppner intended to share these communications with his counsel and eventually did so, it is black-letter law that non-privileged communications are not somehow alchemically changed into privileged ones upon being shared with counsel. Thus, because the AI Documents "would not be privileged if they remained in [Heppner's] hands," they did not "acquire protection merely because they were transferred" to counsel.

{At oral argument, Heppner's counsel suggested in passing that the AI Documents may be privileged because they "incorporated information that we had conveyed to Mr. Heppner over the course of our representation." Tr. at 3. But even if certain information that Heppner input into Claude was privileged, he waived the privilege by sharing that information with Claude and Anthropic, just as if he had shared it with any other third party. Further, in light of Anthropic's privacy policy discussed above, Heppner had no reasonable expectation that the inputs would not be shared with other third parties.} …

Related to but distinct from the attorney-client privilege, the work product doctrine, "[a]t its core[,] … shelters the mental processes of the attorney, providing a privileged area within which he can analyze and prepare his client's case." The doctrine "provides qualified protection for materials prepared by or at the behest of counsel in anticipation of litigation or for trial." …

The AI Documents do not merit protection under the work product doctrine because, even assuming, arguendo, that they were prepared "in anticipation of litigation," they were nevertheless not "prepared by or at the behest of counsel," nor did they reflect defense counsel's strategy. As to the former, Heppner's counsel confirmed that the AI Documents "were prepared by the defendant on his own volition." That means that Heppner was not acting as his counsel's agent when he communicated with Claude. As to the latter, counsel conceded that while the AI Documents did "affect" counsel's strategy going forward, they did not "reflect" counsel's strategy at the time that Heppner created them….

Heppner[ cites] Shih v. Petal Card, Inc. (S.D.N.Y. 2021). In that case, a Magistrate Judge in this District authorized the plaintiff to withhold certain communications that she had with an individual who was then her lawyer, and later became her husband, that the plaintiff prepared in anticipation of litigation or for trial. The court held that the work product doctrine protected such communications, "regardless of whether [the lawyer/husband] was acting as her counsel at the time, and without showing that another attorney 'directed the work.'"

Shih, of course, is not binding on this Court, and this Court respectfully disagrees with its holding. As relevant here, the court in Shih principally concluded that the work product doctrine is not limited to materials prepared by or at the direction of an attorney. Id. But that conclusion undermines the policy animating the work product doctrine, which, as one of the cases cited in Shih explains, is "to preserve a zone of privacy in which a lawyer can prepare and develop legal theories and strategy 'with an eye toward litigation.'"While it is true that the work product doctrine may apply to materials generated by non-lawyers, the Second Circuit has repeatedly stressed that the purpose of the doctrine is to protect lawyers' mental processes.

Here, there is no dispute that Heppner acted on his own when he created the AI Documents. Because the AI Documents were not prepared at the behest of counsel and did not disclose counsel's strategy, they do not merit protection as work product….

Generative artificial intelligence presents a new frontier in the ongoing dialogue between technology and the law. Time will tell whether, as in the case of other technological advances, generative artificial intelligence will fulfill its promise to revolutionize the way we process information. But AI's novelty does not mean that its use is not subject to longstanding legal principles, such as those governing the attorney-client privilege and the work product doctrine. Because Heppner's use of Claude fails to satisfy either of these rules, the AI Documents do not merit the protections Heppner has claimed.

Daniel George Nessim and Alexandra Rothman of the S.D.N.Y. U.S. Attorney's office represent the U.S.