United States v. Heppner: The Ruling
1On February 10, 2026, Judge Jed S. Rakoff of the U.S. District Court for the Southern District of New York ruled from the bench that 31 documents a criminal defendant generated using Anthropic's Claude (the consumer version) were not protected by attorney-client privilege or the work product doctrine. Judge Rakoff issued a written opinion on February 17, 2026 explaining the decision.
2The court characterized the question as a "nationwide matter of first impression": whether communications with a publicly available AI platform during a pending criminal investigation are protected by privilege or work product. The answer was no on every ground the defense raised.
Background Facts
3Bradley Heppner, former executive of GWG Holdings, Inc., was indicted October 28, 2025 on charges of securities fraud, wire fraud, conspiracy to commit wire and securities fraud, giving false statements to auditors, and falsifying corporate records. The government alleged he looted more than $150 million from the company.
4After receiving a grand jury subpoena and engaging defense counsel from Quinn Emanuel, Heppner used the consumer version of Anthropic's Claude to prepare reports outlining his defense strategy and potential legal arguments. He did this of his own volition. His attorneys did not direct him to use Claude. He later shared the documents with his counsel.
5When FBI agents executed a search warrant at his residence following his arrest on November 4, 2025, they seized electronic devices containing the 31 AI-generated documents. Defense counsel identified the documents and asserted privilege. The government moved for a ruling that no privilege attached.
6The parties entered a Privilege Protocol Stipulation keeping the documents segregated pending resolution. On February 6, 2026, the government moved for a determination. Judge Rakoff heard argument on February 10 and ruled from the bench. The written opinion followed on February 17.
The Three Grounds
7Judge Rakoff held that Heppner's privilege claim failed on at least two of the three required elements of attorney-client privilege. Any one failure was sufficient to defeat the claim.
8Claude is not a licensed attorney. Heppner did not, and could not, maintain that Claude is an attorney. The court held that all recognized privileges require a trusting human relationship with a licensed professional who owes fiduciary duties and is subject to discipline. That relationship cannot exist with an AI platform. The communications were between Heppner and a software system, not between a client and counsel.
9This is the finding with the broadest implications beyond the Heppner facts. Anthropic's privacy policy expressly notifies users that it collects data on user inputs and Claude outputs to train its models, and reserves the right to disclose that data to third parties, including governmental regulatory authorities. Judge Rakoff held there was simply no reasonable expectation of confidentiality. The tool, in the court's words, "contains a provision that any information inputted is not confidential."
10The court noted this is not unique to Claude. OpenAI's privacy policy contains comparable provisions. A $20-per-month subscription, multiple post-ruling analyses noted, does not change the underlying terms. Only enterprise-tier agreements with contractual data handling terms offer different protections, and even those have been subject to scrutiny in subsequent proceedings.
11Heppner communicated with Claude of his own volition. His counsel did not direct him to run the searches. The AI tool itself explicitly disclaims the ability to provide formal legal advice or make legal recommendations. The government specifically highlighted Claude's terms in this regard. The court held the communications were not made for the purpose of obtaining legal advice from a licensed professional.
12The work product doctrine protects materials prepared by counsel, or at counsel's direction, in anticipation of litigation. Defense counsel conceded that Heppner created the documents of his own volition and that the legal team did not direct him to run the AI searches. Without attorney direction, the core purpose of the doctrine (protecting the mental processes and strategy of attorneys) was absent. The documents did not reflect the mental processes of his attorneys at the time of creation.
13The court expressly disagreed with a prior SDNY magistrate judge decision that had extended work product protection to materials generated by non-lawyers without attorney direction. Judge Rakoff held that the core purpose of the doctrine is to protect lawyers' mental processes, and that protection did not extend here.
The Open Question the Court Left
14Judge Rakoff noted that had counsel directed Heppner to use Claude, the analysis might differ. Claude might then have functioned "in a manner akin to a highly trained professional who may act as a lawyer's agent within the protection of the attorney-client privilege" under the Kovel doctrine. That question was not before the court and was not decided.
15The Kovel doctrine extends privilege to communications with nonlawyer agents whose assistance is necessary to facilitate the attorney-client relationship, provided the agent operates under counsel's direction and confidentiality is maintained. Whether an AI tool used at counsel's direction, inside a private system with contractual data handling terms, could qualify as a Kovel agent is a question courts have not yet addressed.