By Andrew Flake
Under what circumstances will a party’s case-related communications with an AI platform be attorney-client privileged or protected as work product? In United States v. Heppner, issued February 17, 2026, Judge Jed Rakoff of the Southern District of New York considered this question – so far as it appears, one of first impression nationally – in the context of a government search warrant.
After analyzing both attorney-client and claimed work product, the opinion concludes that neither applied to Heppner’s materials; although it applies traditional principles of privilege, given both the prevalence and remarkable sophistication of AI tools available to litigants, the analysis is an important one, yielding some notable cautions and insights for counsel.
The background: A white-collar criminal defendant, Heppner was indicted in October 2025 for, among other corporate offenses, securities and wire fraud and making false statements to auditors; he was alleged to have engaged in self-dealing and to have defrauded investors in several companies, including one public company, of more than $150 million. He was arrested in November 2025, at the same time and in connection with which the FBI executed a search warrant for Heppner’s records.
Among the materials seized were thirty-one documents containing the defendant’s legal Q&A with Anthropic’s AI Platform, Claude. Heppner had used Claude prior to his arrest but after receiving a grand jury subpoena making it clear that he was a target of the government’s investigation. He had retained defense counsel, and spoken to them about his case.
On his own, Heppner then queried Claude about his case, inputting information about the subpoena, about the case generally, and about communications he had engaged in with counsel, to generate suggested defense strategy and to test-run factual and legal arguments he might make.
Considering attorney-client privilege first, Judge Rakoff began with the straightforward point that Claude is not an attorney, not a licensed professional who owes fiduciary duties, one of the predicates for the privilege to apply.
Next, Heppner’s “discussions” with Claude were not confidential. The Anthropic privacy policy applicable to his usage provided that inputs could be used for training and shared with third-parties, including the government. Where Anthropic could retain and use those materials as part of its normal business policies, Heppner could not have any reasonable expectation of privacy in his submissions. At least as to the training point, it seems clear that Heppner had not adjusted the program’s default permissions; it is possible he might, at least under this prong, have avoided waiver by being able to show that those permissions had been disabled.
Relatedly, Judge Rakoff also comments that Claude is not “like confidential notes that a client prepares with the intent of sharing them with counsel,” – that in the case of Claude, Heppner first “shared the equivalent of his notes with a third-party, Claude.” This point, it seems to me, is neither necessary to the Court’s reasoning nor the most compelling. A cloud-based word processor, like Microsoft Word or Pages, might also be the repository of a Defendant’s thoughts about a case. Might a client be said to have “shared” thoughts with Microsoft as a third-party? The answer has less to do with the technology — Microsoft Word or Apple’s Pages, say — and more to do with the terms of the privacy policy and security employed.
And last, in what is the more interesting and nuanced point, the Court concluded that Heppner’s Claude discussion was not “for the purpose of obtaining legal advice.” He used the AI platform on his own, without suggestion from his counsel.
Previewing a decision for another day, Judge Rakoff observes that “[h]ad counsel directed Heppner to use Claude, Claude might arguably be said to have functioned in a manner akin to a highly trained professional who may act as a lawyer’s agent within the protection of the attorney-client privilege.” Just as discussions among business people in a company might be privileged, where they are undertaken at the direction of counsel, we can imagine controlled scenarios in which the client’s AI use is attorney-directed.
Concerning the claim that the Claude AI documents were protected by the work product doctrine, it was dispositive for the Court, again, that the Claude documents were not prepared by or at the request of counsel. Work product is designed to protect counsel’s mental impressions – areas like trial strategy, views on legal issues, assessments of the strength of evidence – and Heppner’s Claude documents did not, according to the Court, reflect defense counsel’s strategy.
Of course, whether the Claude queries reflected defense strategy *at the time*, Heppner’s counsel conceded that they did affect strategy going forward. If that is the case, I would imagine that disclosure of these outputs to the government was of equal or greater concern than disclosure of Heppner’s own queries and prompts: the opinion suggests that Claude’s take on defense strategy was passed along to counsel and, at least in part, informed their approach.
The takeaways from Heppner, then, include at least the following:
- Counsel should include in their early discussions with clients whether, and how, the client intends to use AI
- If not prohibiting the client’s AI use related to the case entirely, for sensitive communications, counsel should ensure it is done at the express request of counsel and in a manner that counsel has approved
- Counsel should ensure that the direction to use AI, and the justifications for it, are documented internally, should a challenge arise and should the communications need to be logged
- The potential for an argument concerning waiver arising from client AI use is high – outside of an in-house or paid enterprise application or account, the use of any free AI platform seems fraught.
- If AI is to be used, counsel should ensure that the client understands privacy permissions, and that the appropriate tool – not a public-facing application, and not one that permits use of data for model training — is deployed.
We’re at the very beginning of judicial application of principles like privilege to generative AI, and Heppner is only one of many opinions on the topic we can expect. Among other issues to watch: the discoverability of party AI use, and the extent to which AI queries need to be preserved in litigation; arguments about the relevance of those queries and outputs (in the context of at least Fed. R. Evid. 403); and the extent to which non-privileged AI queries might be used at trial as admissions.
[The case is United States v. Heppner, 2026 U.S. Dist. LEXIS 32697, at *9 (S.D.N.Y. Feb. 17, 2026).]