Justice Jed Rakoff’s recent opinion in United States v. Heppner has sparked considerable debate among litigators as the apparent first finding that leaking information to consumer generative artificial intelligence tools precludes claims of attorney-client privilege over both the inputs and outputs of the tools.
The ruling may not come as a surprise to lawyers, but it may be news to clients.
It is black letter law that non-privileged communications cannot be somehow alchemically transformed into privileged communications when shared with a lawyer.
With that in mind, heppner Although this is a criminal case, and the documents in question were discovered during the execution of a search warrant and not through pretrial discovery, the court’s decision is a warning for clients who increasingly use artificial intelligence to conduct legal research even after engaging an attorney.
Attorney-client privilege applicable to AI
The court’s discussion of attorney-client privilege in the context of artificial intelligence is neither surprising nor new. In recent years, the American Bar Association and many state attorney regulators have urged lawyers to be extremely careful when sharing sensitive client information with generative AI tools. Issues of professional ethics and attorney-client privilege have been thoughtfully raised and discussed in detail.
In Formal Opinion 512, issued on July 29, 2024, the American Bar Association’s Standing Committee on Ethics and Professional Responsibility identified several ethical obligations that arise when lawyers use generative AI tools on behalf of their clients.
The first is the ethical obligation of competence and the related obligation of technical competence. ABA Model Rule 1.1 requires attorneys to understand the “benefits and risks associated” with the technology they deploy. Regarding AI, the ABA writes that lawyers do not need to become experts in AI, but they must have a reasonable understanding of how certain tools work and must stay current as the technology evolves.
The second is the ethical obligation to protect confidential customer information. ABA Model Rule 1.6 requires attorneys to make “reasonable efforts to prevent inadvertent or unauthorized disclosure of, or unauthorized access to, information related to the representation.” The ABA has concluded that self-learning GAI tools (tools that train based on user input) pose a direct threat to this ethical obligation.
Prior to this, on November 16, 2023, the California Bar issued practical guidance on the use of generative artificial intelligence in the practice of law. In the document, the lawyers warned that lawyers “must not enter confidential client information into generative AI solutions that lack appropriate confidentiality and security protections.”
And this blog published an extensive list of guidance from other state attorney regulators regarding the ethical use of artificial intelligence in 2023 and 2024.
Perhaps the client misunderstands the permissions
It’s safe to say that lawyers in 2026 will be well aware of the dangers of using generative AI tools in their legal practices.
However, their dangers are largely unknown to clients.
in heppner In this case, the defendant received a grand jury subpoena, engaged a defense attorney, and then used the consumer version of Anthropic’s Claude AI tool to generate a report outlining defense strategy and potential legal arguments. Federal agents subsequently seized the resulting documents (31 in total) during a search of his residence. Hepner’s lawyers tried to claim attorney-client privilege over these documents, but it was too late. The horse was already out of the barn.
Judge Rakoff cited three reasons why attorney-client privilege cannot be asserted over the seized documents:
- The documents were communications between the defendant and Claude Toole. Claude is not a lawyer. Judge Rakoff said Claude was more like a word processor than a lawyer with some kind of fiduciary duty to his clients.
- The documents contained non-confidential communications. Claude’s privacy policy warned that information submitted by users could be shared with “third parties,” including governments.
- Defendant may have communicated with Claude for the purpose of sharing the results with his attorney, but in fact he had no requisite intention to seek legal advice from Claude. The defendant used Claude on his own, without the knowledge or advice of his attorney.
“The communications between Hepner and Claude were not privileged at the time they took place,” the court said. “Furthermore, even assuming that Heppner intended to share these communications with his attorneys and ultimately did so, it is a dark law that non-privileged communications cannot be somehow alchemically transformed into privileged communications when shared with attorneys.”
Similar considerations led the court to reject defendant’s argument that the document was protected as an attorney’s work.
The real point is heppner Customers who use consumer artificial intelligence tools to gain insight into their cases are very likely to be unwittingly creating evidence against them in criminal or civil cases. Remember: heppner contained a document containing both the defendant’s prompts to Claude and Claude’s responses. Where relevant, both types of documents may be sought through document requests, interrogatories, and deposition interrogations in pretrial discovery in civil cases.
Unless the attorney-client privilege is protected, disclosure of this information could seriously harm the client’s interests. Prudent litigators may want to consider warning their clients about the dangers of artificial intelligence tools as early as possible in the argument, assuming they have not already done so.
