Consumer-facing generative AI is making waves in many aspects of our lives, from meal planning and musical choices to even some helpful drafting.
But what about pre-litigation legal advice? A recent ruling out of the Southern District of New York has waded into these unchartered waters. And as that decision makes clear, companies and law firms should be clear-eyed about the risks of using AI. More specifically, they should understand that the information a user provides in generative AI prompts—or documents generated by an AI platform—may not be privileged or enjoy work product protection, or may affect a waiver of those same protections.
Background
In United States v. Heppner, the defendant Bradley Heppner was indicted on multiple federal charges for financial crimes, including wire fraud. When Heppner was arrested at his Dallas mansion in November 2025, FBI agents also executed a search warrant. With that search warrant, the agents seized dozens of electronic devices. His defense counsel quickly claimed the attorney-client privilege and work product protection over his case-relevant, pre-arrest queries to Claude, Anthropic’s generative AI tool, as well as documents Claude generated based on Heppner’s inputs.
It appears defense counsel did its best to provide a factual record in support of claims of privilege and work product protection: some of Heppner’s inputs included information he learned from his lawyers; he created the Claude-generated documents for the “express purpose of talking to counsel” and obtaining legal advice; and he shared the AI-generated documents with his lawyers. Critically, though, Heppner and his lawyers did not say that he used Claude or prepared the Claude-generated documents at the direction of counsel.
Judge Rakoff’s Ruling—Attorney-Client Privilege
Judge Jed Rakoff rejected Heppner’s privilege and work product claims over his inputs to Claude, and the Claude-generated documents. Judge Rakoff applied the Second Circuit’s requirements for the attorney-client privilege—which are essentially identical to those under Colorado law and the Tenth Circuit: (1) communications between a client and his attorney; (2) that are intended to be, and were, kept confidential; and (3) for the purpose of obtaining or providing legal advice.
Judge Rakoff found at least two, if not all three, of the elements missing with respect to Hepper’s generative AI use. First, these were not attorney-client communications. As Judge Rakoff put it, “Heppner does not, and indeed could not, maintain that Claude is an attorney.” Therefore, Heppner’s back-and-forth with a non-attorney, albeit software, defeats the privilege.
Second, the AI prompts and documents were not confidential. Judge Rakoff suggested that any “communicat[ion] with a third-party AI platform” is per se not confidential. But in this case, he relied on Claude’s written privacy policy, which says it collects data on users’ inputs and its responses. Further, Claude reserves the right to disclose that data to third parties. Therefore, Heppner “could have had no reasonable expectation of confidentiality in his communications with Claude.”
And third, because Heppner’s lawyers did not direct him to use Claude, his generative-AI interactions were not “for the purpose of obtaining legal advice.” Judge Rakoff called this a “closer call,” but because Heppner communicated with Claude “of his own volition,” this element weighed in favor of rejecting the attorney-client privilege.
Judge Rakoff’s Ruling—Work Product
For similar reasons, Judge Rakoff found Heppner’s AI interactions did not enjoy work product protection. The work product doctrine is potentially both broader than the attorney-client privilege, and narrower than it. Whether under the laws of the Second Circuit, the Tenth Circuit, or Colorado, the doctrine generally protects from discovery any materials prepared by or at the direction of counsel “in anticipation of litigation.” Judge Rakoff appeared to find dispositive the fact that Heppner’s AI interactions were “not prepared by or at the behest of counsel, nor did they reflect defense counsel’s strategy.”
But Judge Rakoff’s work product ruling is somewhat unsatisfying because it did not fully reconcile the rejection of the work product privilege here with the fact that work product protection can extend to the work of non-lawyer representatives of a party, including “agents,” so long as such documents were created in anticipation of litigation. See Fed. R. Civ. P. 26(b)(3) (“Ordinarily, a party may not discover documents and tangible things that are prepared in anticipation of litigation or for trial by or for another party or its representative (including the other party’s attorney, consultant, surety, indemnitor, insurer, or agent).”); C.R.C.P. 26(b)(3) (protecting materials “otherwise discoverable . . . and prepared in anticipation of litigation or for trial by or for another party or by or for that other party’s representative (including the party’s attorney, consultant, surety, indemnitor, insurer, or agent).”).
Though Judge Rakoff did acknowledge that “it is true that the work product doctrine may apply to materials generated by non-lawyers,” in the same sentence he rejected the application of that principle by relying on the core concern of the work product doctrine: “the Second Circuit has repeatedly stressed that the purpose of the doctrine is to protect lawyers’ mental processes.”
The Government did not argue—and Judge Rakoff did not discuss—whether disclosure to Anthropic/Claude waived the work product protection. Because disclosure to a third party does not necessarily waive work product protection, that argument may not have succeeded. Indeed, at least one federal district court has held that disclosure to ChatGPT does not waive work product protection. See, e.g., Warner v. Gilbarco, Inc., Case No. 2:24-cv-12333 (E.D. Mich. Feb. 10, 2026) (“[T]o the extent Defendants argue that Plaintiff waived the work-product protection by using ChatGPT, the work-product waiver has to be a waiver to an adversary or in a way likely to get in an adversary's hand. And ChatGPT (and other generative AI programs) are tools, not persons, even if they may have administrators somewhere in the background.”) (internal citations omitted).
Takeaways
Judge Rakoff’s order highlights how one way to use generative AI is likely discoverable. But that doesn’t mean all use of generative AI is not privileged or protected as work product.
.png)
