US v. Heppner (S.D.N.Y. 2026) no attorney-client privilege for AI chats [pdf]

Related:

https://news.ycombinator.com/item?id=47778308 AI ruling prompts warnings from US lawyers: Your chats could be used against you (reuters.com)

~3 hours ago, 43+ comments

https://news.ycombinator.com/item?id=47555642 Be careful: chatting with AI about your case is discoverable (harvardlawreview.org)

~18 days ago, 13 comments

How is this not effectively a ban on representing yourself in court? The lawyers and judge are going to be using AI. But the layman isn't allowed to use it?

people point out in sibling comments that is phone call then be out of client-attorney privileges? since it goes through a "3rd party"? maybe not the call itself but the voicemail for example. can it be "extracted" for the same purpose?

another point to make it safer would be sharing the "chat" with the lawyer, this way it becomes media of communication.

Obviously this (along with the original unwritten order a few weeks ago) is causing a stir, but this decision isn't as weird as it sounds. The defendant's assertion was essentially a retroactive application of privilege: he didn't use Claude to draft documents at his attorney's request but instead used Claude effectively in lieu of an attorney and later provided the Claude-drafted materials to his attorney (heavily paraphrasing here). Privilege is not a bandage that closes self-inflicted wounds.

I have some concerns about some of the reasoning, namely the practical implications of referencing Claude's TOS in a world where public AI features are creeping into everything, but I expect some of the reasoning is based on this particular defendant likely being more sophisticated than an average person.

The headline is a bit misleading.

It's not "no attorney-client privilege for AI chats" in general.

But a situation where the same would also apply if, instead of going to an chat bot, the person had gone to a random 3rd party non-attorney related person.

As in:

- the documents where not communication between the defendant and their attorney, but the defendant and the AI

- the AI is no attorney

- the attorney didn't instruct the defendant to use the AI / the court found the defendant did not communicate with the AI with the purpose of finding legal consule

- the communications with the AI (provider) where not confidential as a) it's a arbitrary 3rd party and b) they explicitly exclude usage for legal cases in their TOS

Still this isn't a nothing burger as some of the things the court pointed out can become highly problematic in other context. Like the insistence that attorney privilege is fundamentally build on a trusting human relationship, instead of a trusting relationship. Or that AI isn't just part of facilitating communication, like a spell checker, word program or voice mail box, legal book you look things up. All potentially 3rd parties all not by themself communication with a human but all part of facilitating the communication.

I highly recommend everyone actually read the opinion. It's such a thorough legal takedown of Heppner, you'll learn how the law works and why it doesn't apply to a lot of the made up cases in this thread:

TLDR:

- Claude told him IANAL

- Claude privacy policies say they "may disclose personal data to third parties in connection with claims, disputes, or litigation"

- Work product doctrine, does not apply in the same way to plaintiffs

- Lawyers did not direct him to use Claude (i.e. the laywers did not direct him to do research for the case using a specific tool)

My takeaway is that, as is, I should not do any work without a VPN or in plaintext. Everything else was up for grabs even before this case.

There is no way that this state of things survives long-term. Rationally, it's really no different than any other tool involved in production of your work product.

FWIW not all cases have gone the same way, so there is likely to be a higher reckoning on this in multiple countries: https://fingfx.thomsonreuters.com/gfx/legaldocs/mypmyjwdzpr/...

I'm not surprised at all. Corporate LLM chats are saved, used as training corpus, and are definite target for discovery.

Running your own LLM on your own hardware is how you can do this without getting hit with discovery.

And also, you want to run a LLM thats abliterated and larger. And if you connect to the internet, USE A VPN.

Previously: https://news.ycombinator.com/item?id=47555642

I'm guessing a self-hosted chat remains privileged?

This is a pretty terrible decision and inconsistent with all sorts of all other standards. If I did legal research in Google docs, it'd be covered. If I went to a legal library and took notes, it'd be covered, etc

Heppner's argument was dumb but it opens a field of interesting questions. If I use a document processor (like Google Docs) to compose a message to my attorney, which message itself would be privileged, but I use some sidebar feature of Google Docs/Gemini to clean up a sentence that I thought was clunky, and elsewhere I have, for whatever reason, enabled features that permit Google to use inputs and outputs to train or refine their models, has that destroyed the privilege?