Federal Court Rules Prompts to Public AI Platforms Are Not Protected by Attorney-Client Privilege

The modern executive faces a dilemma: they have a powerful artificial intelligence assistant on their laptop, but a looming legal crisis on their desk. When they feed legal strategies into the chatbot to organize their thoughts, are they talking to a confidant, or broadcasting to the prosecution?[1]

A landmark federal ruling has just answered that question. In United States v. Heppner, a New York federal judge ruled that prompts and outputs generated by public AI platforms are not protected by attorney-client privilege or the work-product doctrine.[3]

The decision by Judge Jed S. Rakoff of the Southern District of New York serves as a nationwide warning. It clarifies that feeding sensitive legal information into consumer-grade AI tools effectively waives confidentiality, treating the AI not as a legal assistant, but as a third-party stranger.[5]

The case centered on Bradley Heppner, a financial services executive facing federal fraud charges. After receiving a grand jury subpoena, Heppner consulted his attorneys and then turned to Anthropic's Claude to synthesize his defense strategy.[8]

Heppner inputted details he had learned from his legal counsel into the chatbot. In response, Claude generated 31 documents outlining potential defense strategies, which Heppner subsequently shared with his lawyers.[1][7]

When federal agents executed a search warrant at Heppner's residence in November 2025, they seized his electronic devices. The government discovered the AI-generated documents and moved to review them, prompting Heppner's legal team to claim they were shielded by attorney-client privilege.[8]

To understand the court's rejection of this claim, one must examine the mechanics of legal privilege. The attorney-client privilege requires a communication between a client and a licensed attorney, made in strict confidence, for the express purpose of obtaining legal advice.[6]

Judge Rakoff systematically dismantled the defense's argument, starting with the most basic requirement. The court noted that an AI platform is plainly not an attorney. Because the software lacks a law license, fiduciary duties, and professional discipline, interacting with it cannot constitute a lawyer-client communication.[3][8]

The most technically significant part of the ruling focused on the expectation of privacy. The court examined the terms of service for public AI platforms, noting that consumer agreements routinely allow the provider to retain user inputs, use them for model training, and disclose them to government authorities.[1][5]

By agreeing to these terms, the court reasoned, a user forfeits any reasonable expectation of confidentiality. In the eyes of the law, typing privileged information into a public chatbot is functionally identical to discussing a legal strategy loudly in a crowded coffee shop.[2][4]

The defense also attempted to shield the documents under the work-product doctrine, which protects materials prepared in anticipation of litigation. However, this protection typically requires the materials to be prepared by or at the specific direction of legal counsel.[2][6]

Because Heppner initiated the AI queries independently, without his lawyers instructing him to do so, the court ruled the resulting documents were not attorney work product. The fact that he later handed the AI outputs to his lawyers did not retroactively grant them protection.[8]

Legal experts note that the ruling specifically targeted publicly available AI platforms. This leaves an open question regarding enterprise-tier AI systems, which often feature strict data isolation contracts guaranteeing that user inputs are never retained or reviewed by the provider.[1][4]

A separate ruling in Michigan, Warner v. Gilbarco, highlighted this nuance. In that case, a self-represented litigant maintained work-product protection over AI-generated documents because, as a pro se plaintiff, they were acting as their own attorney and the AI was deemed a mere tool rather than a third party.[6]

For businesses and individuals navigating litigation, the mechanical takeaway is clear. Public generative AI tools cannot be used as sounding boards for sensitive legal matters without risking exposure during discovery.[1][7]

The ruling bridges the gap between centuries-old legal doctrines and cutting-edge technology. It establishes that while AI can simulate the reasoning of a lawyer, it cannot provide the legal shield of one, forcing a fundamental rethink of how professionals integrate chatbots into their legal workflows.[5]