In a groundbreaking ruling, Judge Jed S. Rakoff of the U.S. District Court for the Southern District of New York answered a question no court had previously addressed: Are a person’s conversations with a publicly available AI chatbot protected by attorney-client privilege or the work product doctrine? The answer, the court held, is a resounding no.
The Facts
The case, United States v. Heppner, No. 25 Cr. 503 (S.D.N.Y.), arises from criminal charges against Bradley Heppner, an executive accused of defrauding investors in GWG Holdings, Inc. out of more than $150 million through self-serving transactions involving entities he controlled. After Heppner’s arrest in November 2025, FBI agents seized numerous documents and electronic devices from his home, including approximately thirty-one documents memorializing conversations Heppner had with Anthropic’s AI platform, Claude. Heppner’s counsel argued the documents were privileged because Heppner had used Claude to prepare reports outlining defense strategy after learning he was the target of a grand jury investigation, and that he later shared the AI outputs with his attorneys. The Government moved for a ruling that the documents were protected by neither the attorney-client privilege nor the work product doctrine, and the court agreed.
Attorney-Client Privilege: Three Strikes
Judge Rakoff found that the AI Documents failed on multiple elements of the attorney-client privilege. First, Claude is not an attorney, and discussions of legal issues between two non-attorneys are not protected. Second, the communications were not confidential. Anthropic’s privacy policy expressly provides that user inputs and AI outputs may be collected, used for training, and disclosed to third parties, including governmental authorities. As the court put it, Heppner could have had “no reasonable expectation of confidentiality in his communications” with Claude. Third, Heppner did not communicate with Claude for the purpose of obtaining legal advice. Claude itself disclaims any ability to provide legal advice, and Heppner’s counsel conceded they never directed him to use the platform. The court further noted that non-privileged communications are not “alchemically changed into privileged ones upon being shared with counsel.”
Work Product Doctrine: No Shelter Either
The court similarly rejected the work product defense. The work product doctrine protects materials prepared by or at the behest of counsel in anticipation of litigation. Here, Heppner acted on his own volition when creating the AI Documents; his counsel did not direct him to use Claude. Moreover, while the AI Documents may have later “affected” counsel’s strategy, they did not “reflect” counsel’s strategy at the time of their creation. The court emphasized that the purpose of the work product doctrine is to protect lawyers’ mental processes, not to broadly shield any document a defendant prepares on their own initiative.
The Takeaway
Judge Rakoff closed with a forward-looking observation: “Generative artificial intelligence presents a new frontier in the ongoing dialogue between technology and the law,” but “AI’s novelty does not mean that its use is not subject to longstanding legal principles.” The message for legal practitioners and their clients is clear. If you type sensitive, privileged, or strategy-related information into a public AI platform, you may be waiving the very protections you seek to invoke. Attorneys should proactively counsel clients about the risks of using AI tools for case-related communications, and organizations should update their data-handling policies accordingly.
