For the last few months a single federal ruling has traveled with the same caption attached: AI just destroyed attorney-client privilege. The case is United States v. Heppner, decided in the Southern District of New York by Judge Jed Rakoff, with a written opinion backing the bench ruling. The facts are easy to dramatize. Bradley Heppner, an executive facing securities and wire fraud charges, had already retained counsel when he used the consumer version of Claude to work through his own case - on his own, without counsel directing the work. He fed in information he had learned from his lawyers, generated reports laying out defense strategy, and later showed those reports to counsel. The FBI seized thirty-one documents memorializing those exchanges during a search of his home. The court ruled they were protected by neither attorney-client privilege nor the work product doctrine. The government can use them.
Stop there and it reads like a warning about the technology. It is not.
The doctrine did not change
Judge Rakoff applied rules that predate the technology by a century. Attorney-client privilege protects confidential communications with a lawyer - or a lawyer's agent retained to help deliver legal advice - made for the purpose of obtaining that advice. Claude was none of those things here. It was not counsel, it was not retained by counsel as an agent, and Heppner used it outside his lawyers' direction. The court was careful about that last point: it suggested the result might have come out differently if counsel had directed the use, which could have cast the tool as the lawyer's agent. The problem was not that a machine was involved. It was that the machine sat outside the relationship privilege protects.
And here is the part worth underlining. Heppner could not cure the problem after the fact by forwarding the documents to his attorneys. As the court put it, non-privileged communications are not “alchemically changed into privileged ones upon being shared with counsel.” The material was never privileged in his hands, so it did not become privileged in theirs.
The case the alarm posts leave out
The same week, in another federal court, a related situation came out the other way. In Warner v. Gilbarco, a self-represented plaintiff used a generative AI tool, ChatGPT, to help prepare her own employment case. The defense moved to compel her queries and the tool's responses, arguing she had waived protection by feeding litigation material to a third party. Magistrate Judge Patti refused, holding the materials were protected work product. The order came down the same day Judge Rakoff ruled from the bench in Heppner.
Same category of tool. Opposite result.
The reason is not that one court liked AI and the other did not. It is that the cases sat in different postures, and different rules applied. Heppner was criminal and represented, so the court used the attorney-centric work-product test and asked whether counsel had prepared or directed the documents. The answer was no. Warner was civil and pro se, so the court applied Rule 26(b)(3)(A), which protects material prepared “by another party or its representative,” not only by a lawyer - which puts a litigant preparing her own case squarely inside it. And work product, unlike privilege, is waived only by disclosure to an adversary, or in a way likely to reach one. On the terms that court considered, ChatGPT was neither.
That last point carries a warning the Warner court did not have to reach. It did not scrutinize the platform's terms. A court that does - as Heppner did - can find that a consumer tool whose policy permits disclosure to the government is exactly the kind of channel likely to put material in an adversary's hands. Whether an AI platform is “neither” is not a fact about AI. It is a fact about the terms on the door you used.
The technology was incidental to both outcomes. Relationship, purpose, posture, and terms decided them, exactly as they would have a century ago.
Where Heppner was standing
There is a second ground in Heppner that most of the screenshots skip, and it is the one that should interest anyone who read the earlier pieces in this series. Rakoff did not rest only on the absence of a lawyer. He also found the conversations were not confidential - because the court read Claude's consumer terms to permit training on user inputs and disclosure to third parties, including the government. The court read the privacy terms and held they defeated any expectation of confidentiality.
Readers of this series will recognize the spot. Earlier I described the three doors into these tools - the consumer app, the business tiers, and a contracted zero-retention path - and noted that the consumer app carries the weakest protection of the three, and is the one people reach for precisely because it is frictionless. Heppner walked through the first door. The risk that piece described in the abstract now has a docket number, and a federal judge reading the same terms I was reading.
What Heppner does not say
Because the alarm version travels faster than the holding, be precise about the limits.
Heppner does not say a lawyer who uses AI waives privilege. It does not say enterprise or contracted AI tools are unprotected - no court has held that, and the confidentiality terms on those tiers cut the other way. It does not say AI has no place in a defensible practice. Confidentiality is necessary, not sufficient: a sandboxed enterprise tool helps the confidentiality element, but it cannot manufacture a lawyer, or a legal-advice purpose, where neither exists.
And it leaves open the questions that matter most for practice. The court flagged - and decided none of - whether an attorney's own use of these tools is protected, whether a non-public or enterprise tool changes the confidentiality analysis, and whether a client using AI at counsel's direction can claim protection over the outputs. Even sympathetic readers think the opinion reaches too far in spots, treating the tool more like a person than a word processor. That critique is about the reasoning, not the result on these facts. What Heppner actually holds is narrow: a represented defendant's solo, undirected use of a consumer chatbot, under terms the court found inconsistent with confidentiality, produced nothing privileged or protected.
The part that should actually worry a lawyer
There is a sharper edge in the opinion, and it cuts toward counsel, not just toward clients who go it alone. On a limited record, Rakoff indicated that even if some of the information Heppner typed into Claude was privileged - because it had come from his lawyers - he waived that privilege by feeding it to the tool, just as if he had handed it to any other third party.
Sit with that. The headline is that the AI documents were never privileged. The quieter point is that privileged material poured into a consumer tool can lose its protection over the originals, too. The danger is not only the new transcript you create. It is the protected communication you dissolve by pasting it somewhere whose terms do not hold it. That is a competence problem, and it belongs to the lawyer, not the layperson - the duty to protect the client's confidences extends to the tools you pour them into (Model Rule 1.6; 37 C.F.R. 11.106 before the USPTO).
What to actually do
The takeaway is not fear, and it is not avoidance. It is three questions, asked before sensitive facts touch any AI tool.
Is this use inside a protected relationship, and at counsel's direction, or outside both? Privilege and work product attach to the relationship, the purpose, and the posture - not to the transcript.
Which door am I using, and do its terms match the sensitivity of this matter? The brand on the login screen is not the term that governs your client's confidence.
And am I pouring privileged material into a tool whose terms will not hold it? Because that can break protection over the original communication, not just leave a new transcript exposed.
A lawyer who can answer those is not exposed by Heppner. A client typing defense strategy into a free chatbot is - and was, long before this ruling, under rules every litigator already knew.
The courts are not turning against AI. They are doing the ordinary thing: applying old law to new facts and getting sensible, fact-specific results. The people unsettled by Heppner are the ones who mistook a transcript for a relationship. The ones who read it carefully - both halves of it, Warner included - will notice it changed less than the headlines claim. Which, for a doctrine this old, is the most reassuring thing it could have done.
This series is about what these tools keep, and what it takes to get it back out. Next: why deleting your own chat history does not delete the copy a subpoena reaches.
I am writing more about practicing law in the age of agentic AI - using these tools without surrendering judgment, privilege, or the duty of competence - at The Agentic Lawyer. www.theagenticlawyer.com
Educational only, not legal advice, and no attorney-client relationship is created. Views are my own, not my employer's. Attorney advertising in some jurisdictions.
Your best prompts are the ones you'd never bother typing.
The detailed ones. The ones with examples and edge cases. Wispr Flow lets you speak them instead — clean, structured, ready to paste into any AI tool. Free on Mac, Windows, and iPhone.