In a first-ever ruling, a New York criminal court has found that the Defendant’s AI chat history is not protected from disclosure to the prosecution by either the attorney-client privilege or the work-product doctrine. United States v. Heppner, 2026 WL 436479 (February 17, 2026). Recognizing the momentous effect his opinion will have, Judge Rakoff carefully outlined the elements of each, the lens through which it must be seen, and the evaluation of the specific facts before him. 

Defendant Heppner, an executive with a publicly-traded company who also controlled two private companies, was indicted in 2025 for defrauding the public company’s investors by misrepresenting information about his other companies and having it engage in undisclosed transactions that benefitted his other companies. On his arrest, the FBI collected devices and recovered his search history with Claude, Anthropic’s AI platform, including 31 documents representing his questions (called “inputs”) and Claude’s responses (called “outputs”). He had used Claude to prepare reports outlining defense strategies to anticipated charges, and later shared the reports with his criminal counsel after the charges were filed.

Heppner’s counsel objected to production of the Claude history and reports to the prosecution based on both the attorney-client and the work product privileges. In a short, rapid-fire Order, the Court disagreed.

The Attorney-Client Privilege Argument Strikes Out

The Court presaged its analysis with comments on how narrowly privileges must be applied, since they obstruct the full disclosure of pertinent information. To that end, the Court defines communications protected by the attorney-client privilege as between an attorney and a client, intended and in fact kept confidential, for the purpose of obtaining or providing legal advice. Applying the facts of the Claude searches to the definition of privilege, the Court knocks out the Defendant’s claim of attorney-client privilege.

Strike One: Claude is not an attorney.

• The Claude reports were generated by a non-attorney (indeed, a non-human), based on information provided by another non-attorney.

• Court Finding: “In the absence of an attorney-client relationship, the discussion of legal issues between two non-attorneys is not protected.”

Strike Two: Inputs and Outputs Are Not Confidential

• Claude’s written policies, to which Heppner consented in the terms of use, permit Anthropic to use all inputs and outputs to “train” its platform, and to disclose the same to third parties, including government agencies.

• Court Finding: “No user has a reasonable expectation of privacy of any part of the conversation.”

Strike Three: Heppner did not seek legal advice from Claude.

• Claude explicitly disclaims that its responses are legal advice.

• No attorney directed Defendant to search, converse, or create reports.

• Finding: “Non-privileged communications are not somehow alchemically changed into privileged ones upon being shared with counsel.”

The Work Product Privilege Does Not Save the Claude Reports

Again noting the necessity for the narrow application of the doctrine to avoid interfering with discovery, the Court notes that the Work Product doctrine shelters an attorney’s mental processes, analysis, thoughts on preparation of a case, made in anticipation of litigation or at trial. In a short two paragraphs, the Court notes again that Defendant’s Claude reports were NOT requested or directed by an attorney (or an agent), and did not reflect the attorney’s strategy or thought process, because counsel had not been retained at that time.

A Deeper Dive

The consequences to Heppner were that his Claude search history and reports were all turned over to the prosecution, and his criminal case remains pending. Practitioners must be aware, and wary, of clients involved (or threatened) with litigation using AI platforms to “educate themselves” on the issues and arguments they are facing, as this activity has the potential to waive privileges attorneys rely on in giving advice and preparing cases. But even the Heppner Court left open several avenues that would potentially create a different outcome under other circumstances.

One of the most fundamental findings in Heppner that prevented the protection of the Claude searches was the timing: Defendant conducted the Claude conversations before he had retained any counsel. They were his attempt to “get educated” about what he was facing. As a result, the searches were done on his own, of his own volition, and not at the direction of counsel. The Court found this fatal to both privileges – because Defendant’s attorney did not direct or request the Claude reports, Claude could not be an “agent” for purposes of attorney-client privilege, and for the same reason the reports could not be said to reflect the strategy or thoughts of counsel. This analysis ignores the purpose of his research.

A recent ISBA E-clip article and accompanying chart cogently argues that the Claude reports should have been seen as documents (like excel spreadsheets) created for the purpose of gaining legal advice. The Heppner Court mentions this, but gives it no weight, concluding that documents are not “intrinsically” privileged, and that “all recognized privileges require a ‘trusting human relationship,’ such as, in the attorney-client context, a relationship with a licensed professional who owes fiduciary duties and is subject to discipline.” Absent that relationship, no privilege can attach to anything no matter what format it takes. This laser-focus gives short shrift to the Restatement (Third) of the Law Governing Lawyers (2000) which defines “communication” as “any expression through which a privileged person undertakes to convey information to another privileged person and any document or other record revealing such an expression.” If such a document contains thoughts that the client wished to discuss with his attorneys, it should be considered “communication” as defined by Section 69 of the Restatement.

The Heppner Court also concluded that Heppner had no “reasonable expectation of privacy,” because the public nature of AI Platforms, and their click-through rules for use, all disclaim any confidentiality. Claude, among other platforms, is open source, not private. Its terms and conditions of use ask for (and get) users’ consent to the platforms’ use of the inputs and outputs for both training the model, and for disclosure to third parties. In accepting the platform’s consent policy as entirely dispositive, the Heppner Court ignores a body of law and a four-factor test developed to determine whether an expectation of privacy can exist in similar instances, for example, in work emails. In re Asia Global Crossing, 322 B.R. 247 (2005) Applying the factors to Heppner‘s Claude searches could support finding an expectation of privacy:

(1) Personal use – unlike work emails, chats on AI platforms are likely for personal use. Heppner’s searches were certainly personal; this factor would favor protection.

(2) Monitoring – again unlike workplaces, AI chats used for platform ‘training’ are likely reviewed by other software, not people, and not in real time. If there is no human review, this factor favors protection.

(3) Authorized Disclosure - but the terms do not say that disclosure is mandatory or automatic, only theoretical. This factor is neutral here.

(4) Notice of Waivers – click-through terms and conditions, or forcing a user to opt-out of granting such permissions, should not dictate confidentiality. Even when employer policies state explicitly that employees have no expectation of privacy, they can still establish confidentiality under this framework.

This is not to say that all AI searches, or even Heppner’s searches, must be considered confidential, but an analysis using a tested framework would seem appropriate given the consequences.

The final element of attorney-client privilege that the Heppner Court found not satisfied was that the Defendant did not communicate with Claude for the purpose of obtaining legal advice from Claude. Put that way, of course not. However, had the Court considered the purpose of his searches – which was clearly to get smarter about what he needed counsel’s advice about -- the chats could have been considered preparation for obtaining legal advice from a lawyer. The “legal advice” element must turn on the client’s purpose in creating the document, not the tool used to create it, whether Word, Excel, or Claude.

Conclusion

The facts of Heppner were undisputed, and while the legal principles are familiar, the conclusions and finding in Heppner will be the subject of much comment, and perhaps legislation. I also predict that law school Criminal Procedure texts will include it as a bellwether of things to come.

Take Aways:

1. At the initial consultation, find out if the client has used AI Platform to research a problem or a solution.

2. Address AI research and conversations in the Engagement Letter.

3. Issue appropriate Litigation Hold letters – to the client, to any counterparties.

4. If the client has NOT used AI (yet), instruct them (a) what searches to run, so that they are acting on advice of counsel; (b) turn OFF, or decline, all permissions for the Platform to use or disclose the interactions: each platform is different; (c)consider having the client write notes on any report and sharing it with you (securely) for discussion about their legal situation.

5. If the client has ALREADY used AI, find out (a) what they searched and found; (b) whether they gave permission to share. If they did, disclose to them that this may be discoverable, and build your case accordingly.