Your AI Chats Aren’t Secret: A Landmark SDNY Ruling on Privilege

Background: United States v. Heppner (S.D.N.Y. Feb. 10, 2026)

In United States v. Heppner, No. 25-cr-00503-JSR, Judge Jed S. Rakoff of the Southern District of New York addressed for the first time in a written ruling whether communications with a publicly available generative AI platform are covered by attorney-client privilege or the work product doctrine. 

The case arose in the context of a criminal securities and wire-fraud investigation. After learning he was a target of a grand jury subpoena, the defendant used Anthropic’s Claude, a public AI chatbot, on his own initiative to generate analyses of potential defense strategy and legal issues. These AI-generated documents (31 in total) were later found on his devices and turned over to prosecutors. 

The defendant argued that these AI documents were privileged because they were intended to assist with legal advice and were shared with his attorneys. The government moved to compel their production, and Judge Rakoff agreed. 

Why the Court Found No Privilege

The court applied long-established principles of privilege and work product, not a new rule for AI, and concluded that the AI communications failed on multiple fronts: 

No Attorney-Client Privilege

Attorney-client privilege protects confidential communications between a client and a lawyer made for the purpose of securing legal advice. Judge Rakoff agreed with the government that: 

• AI is not an attorney. The AI platform is a third-party tool with no license, no duty of loyalty, and no professional obligation to keep communications confidential. 

• No reasonable expectation of confidentiality. Claude’s user terms and privacy policy expressly allow retention and disclosure of user inputs and outputs to third parties, including governmental authorities. That undermines confidentiality, the core of privilege. 

• Timing and purpose matter. Even though the defendant later shared the AI documents with counsel for legal advice, communications that begin outside the attorney-client relationship with a non-attorney third party aren’t magically privileged simply because they are later forwarded to a lawyer. 

Why Work Product Protection Also Didn’t Apply

The work product doctrine protects materials prepared in anticipation of litigation by or at the direction of an attorney. But in Heppner:

• The AI documents were generated by the defendant on his own initiative, not at the direction of counsel. 

• They did not reflect the mental impressions or strategy of counsel, which is a key requirement for work product protection. 

So the court held that the work product doctrine did not cover the AI documents either. 

Key Legal Implications

This ruling, the first written decision to squarely confront the question, has broad implications for how lawyers and clients interact with generative AI tools:

• Public AI tools are not confidential by default.

Whether it’s Claude, ChatGPT, or another platform, public AI services typically retain rights to use and disclose user inputs. That alone may be enough for courts to view those interactions as unprotected communications. 

• Sharing AI work with counsel doesn’t retroactively create privilege.

Forwarding AI documents to your lawyer after the fact doesn’t convert them into privileged communications. 

• Work product protection is limited when counsel isn’t involved in generating the material.

Preparation without direction or involvement of legal counsel is unlikely to be protected work product. 

Practical Takeaways for Lawyers and Clients

1. Don’t treat public AI chats as confidential.

If you or your clients are using consumer AI tools to analyze legal issues, those prompts and outputs may be discoverable in litigation. 

2. Use secure, enterprise-grade AI tools if confidentiality matters.

Platforms with contractual confidentiality safeguards, where data isn’t retained or shared externally, may offer better protection. But even then, involve counsel in tool selection and use policies. 

3. Think before entering privileged content.

Typing confidential client information, strategic legal issues, or work product into a public generative AI system can risk privilege and work-product loss. 

Conclusion

The Heppner ruling brings traditional privilege and work product doctrines into the age of generative AI. It confirms that courts will look at who you’re communicating with, how confidentiality is preserved, and why the communication was made, not just whether AI was involved. 



In practical terms: a consumer AI chatbot is not your attorney, and its logs may be discoverable. As AI becomes more integrated into legal workflows, lawyers and clients need clear policies to protect confidentiality and privilege when it really matters.