Recent developments in a Southern District of New York criminal case serve as a cautionary tale about the risks of using artificial intelligence (“AI”) tools for legal strategy and communications.
Background
In U.S. v. Heppner, 25 CR 503 (S.D.N.Y.), authorities seized 31 documents memorializing communications between defendant Heppner and the free-tier version of Anthropic’s “Claude” AI tool (the “AI Documents”). Heppner’s counsel asserted that the AI Documents were protected by attorney-client privilege and the work product doctrine. In a motion filed on February 6, 2026, the Government moved the Court for a ruling that the AI Documents were not protected. On February 10, 2026, Judge Jed S. Rakoff issued an oral bench ruling granting the Government’s motion; a written opinion followed on February 17, 2026.
Attorney-Client Privilege
Under applicable law, attorney-client privilege protects communications (1) between a client and attorney (2) made for the purpose of obtaining or providing legal advice (3) that are intended to be, and in fact were, kept confidential. In Heppner, the Government asserted that the AI Documents at issue failed “every element of the attorney-client privilege.”
With regard to the requirement that the communication be between a client and an attorney, the Government noted that Claude “has no law degree and is not a member of the bar,” and that it “owes no duties of loyalty and confidentiality to its users,” nor any professional duties to courts, regulators, or professional organizations.[1]
As to the second element, the Government cited materials published by Anthropic which stated that Claude is designed to avoid giving “specific legal advice” and that users requesting legal advice are instructed to contact an attorney.[2] Based on these materials, the Government argued Heppner could not credibly claim he used the tool to obtain legal advice within the scope of attorney-client privilege.
Third, the Government argued the communications were not confidential. This argument was based primarily on the fact that Heppner used the free-tier public version of Claude, which operates under less-stringent data protection terms. The Government specifically cited Anthropic’s Privacy Policy, which states that user’s “inputs” and “outputs” may be disclosed to third parties (including “governmental regulatory authorities”) and used for model training.[3]
Beyond the element-by-element privilege analysis, the Government argued that forwarding the AI Documents to counsel did not transform them into privileged communications. The Government compared Heppner’s use of Claude to a defendant conducting Google searches or checking out books from the library for legal research, neither of which would be protected from disclosure “simply because the defendant later discussed what he learned with his attorney.”[4]
Judge Rakoff sided with the Government’s position on all elements. The Court underscored that Claude is not an attorney and that discussions of legal issues between two non-attorneys, in the absence of an attorney-client relationship, are not protected. The Court also restated the Privacy Policy’s training and third-party disclosure provisions in concluding the defendant’s use of Claude failed the confidentiality element.
The Court noted that the issue of purpose “presents a closer call,” as defense counsel claimed that Heppner used Claude for the “express purpose of talking to counsel.”[5] In the end, the Court was persuaded by the fact that Heppner communicated with Claude independently rather than at the direction of counsel. The Court noted that “[h]ad counsel directed Heppner to use Claude, Claude might arguably be said to have functioned in a manner akin to a highly trained professional who may act as a lawyer’s agent within the protection of the attorney-client privilege.”[6] The Court also cited the Claude chat transcript provided by the Government, in which Claude recommended consulting a “qualified attorney.”[7]
Work Product Doctrine
The work product doctrine “provides a qualified protection for materials prepared by or at the behest of counsel in anticipation of litigation or for trial.”[8]
Applying this standard, the Court agreed with the Government that the AI Documents were not protected work product because they were not “prepared by or at the behest of counsel” and did not reflect defense counsel’s strategy.[9] Judge Rakoff noted that there was “no dispute” that Heppner acted on his own and that defense counsel “did not direct [Heppner] to run Claude searches,” so the documents did not merit qualified protection as work product.[10]
Practical Takeaways
Heppner serves as a timely reminder that the use of public AI tools can jeopardize privilege and work product protections, and that AI’s novelty does not alter the longstanding legal principles governing both doctrines. Practical tips to mitigate the risks posed by AI use include the following:
- Secure Platforms: Do not use public or free consumer AI tools for legal work. Heppner highlights the importance of carefully reviewing all applicable data protection terms. Training should always be prohibited, and disclosures to third parties should require notice and, where legally permitted, consent.
- Attorney Oversight: Limit AI-assisted legal analysis to work directed and supervised by counsel. Heppner underscores that materials generated without attorney direction are vulnerable to losing privilege, even if later shared with counsel.
- Workflow Documentation: Treat every prompt and output as a document that could end up in the record. In practice, this includes limiting AI use to approved, trained users, and routing all AI activity through controlled channels with clear labeling and centralized storage. If a non-lawyer is using AI, they should record the instances in which a query is being made at the direction of counsel. Furthermore, privilege logs should document the asserted protection, confidentiality measures, and counsel's role.
This Alert provides an update on a legal development. It is not intended as legal advice. For further assistance, please reach out to Brooks Pierce attorneys Claire O'Brien or Graham Dean.
[1] Motion for a Ruling that Documents the Defendant Generated Through an AI Tool Are not Privileged, U.S. v. Heppner, 1:25-cr-00503-JSR (S.D.N.Y. Feb. 6, 2026) Dkt. No. 22 [hereinafter “Motion”], at 8.
[2] Id.
[3] Id. at 9.
[4] Id. at 4.
[5] Memorandum, United States v. Heppner, No. 25-cr-00503-JSR (S.D.N.Y. Feb. 17, 2026), Dkt. No. 27 [hereinafter “Opinion”], at 7.
[6] Id.
[7] Id. at 8.
[8] Motion at 6, citing In re Grand Jury Subpoenas, 318 F.3d at 383.
[9] Opinion at 9.
[10] Id. at 12.