Modern Alchemy. Uncertain Confidentiality of Machine Confessionals.

In 2025 a man under federal investigation did what would have been unthinkable two years before (but a great many people now do when they’re out of their depth). He opened a chat window and started typing. Over the following months he built up around thirty-one documents’ worth of conversation with Claude, working through the case against him, the arguments he might make, and things he had learned from his own lawyers. Then he shared some of it with those lawyers.1

His name is Bradley Heppner, he was indicted on securities fraud, wire fraud, conspiracy, false statements to auditors and falsifying corporate records, and a jury convicted him on four of those counts in May 2026. The government says he diverted more than $150 million of GWG Holdings’ money to himself, in a collapse that cost retail bondholders more than a billion.2 He has become a footnote in a different field entirely, because on February 17, 2026, Judge Jed Rakoff of the Southern District of New York wrote an opinion about those thirty-one documents that anyone using AI at work ought to read.3

I.IANAL (I Am Not a Lawyer)

To be clear, nobody had to subpoena Anthropic to get these chat logs. The FBI seized them from Heppner’s house, along with his devices, when they arrested him in November 2025. His counsel asserted privilege afterwards, the parties agreed to a protocol under which the government would segregate the documents and not read them, and the government then moved in writing for a ruling that the material wasn’t protected.4 So this wasn’t a fight about whether prosecutors could reach into a chat history. It was a contest about whether material already on the table had ever been privileged in the first place.

Two protections were in play here. Attorney-client privilege covers confidential communications between you and your lawyer, made for the purpose of getting legal advice, and it’s close to absolute once it attaches. What is known as the work product doctrine is broader and weaker: it covers material prepared in anticipation of litigation by a party or its representative, and the other side can still get at the ordinary sort by showing it genuinely needs the material and can’t reasonably get the equivalent elsewhere.5 Heppner claimed both and lost both.

On privilege, Rakoff got there three separate ways. The first is the one that made headlines: Claude isn’t an attorney, and “[b]ecause Claude is not an attorney … that alone disposes of Heppner’s claim of privilege.” The second is more interesting and (for corporate readers) considerably more useful. Privilege requires a reasonable expectation of confidentiality, and the court looked at Anthropic’s consumer privacy policy to see whether Heppner could have had one (he couldn’t). The policy permits data collection and reserves the right to disclose to a range of third parties including, in the court’s phrasing, “governmental regulatory authorities.”6 Third, the communications weren’t made for the purpose of obtaining legal advice, a point the opinion illustrates by using Claude’s own words back to him: “I’m not a lawyer and can’t provide formal legal advice or recommendations.”7

Work product fared no better. The documents weren’t prepared by counsel or at counsel’s direction, and they didn’t reflect counsel’s mental impressions. Heppner produced them on his own initiative and then passed them along. One firm’s write-up put the distinction better than I can: material that affects counsel’s strategy isn’t the same as material that reflects it.8 In short, “non-privileged communications are not somehow alchemically changed into privileged ones upon being shared with counsel.”9

II.“Tools, Not Persons”

And yet, if you read only Heppner you’d come away with entirely the wrong picture, because four other courts looked at different facets of the same question over the same period and went the other way.

A week before Rakoff ruled, Magistrate Judge Anthony Patti in the Eastern District of Michigan refused to let defendants go digging through a plaintiff’s ChatGPT use. His reasoning was that work product waiver, unlike privilege waiver, requires disclosure to an adversary or in a manner likely to put the material in an adversary’s hands, and typing into a chatbot isn’t either. “ChatGPT (and other generative AI programs),” he wrote, “are tools, not persons, even if they may have administrators somewhere in the background.”10

In March, a magistrate judge in Colorado followed him almost word for word, holding that AI-assisted litigation preparation is protected work product under Rule 26(b)(3) and that feeding material into a publicly available tool doesn’t automatically waive.11 In June, a New York state judge in Nassau County went further and quashed a subpoena served on OpenAI directly (which is as close to the nightmare scenario as anyone has yet come). Justice Fischer analogized the defendant’s AI use to “jotting notes on a legal pad or talking through strategy with a colleague,” and held that data collection by a third party “does not eliminate all expectations of privacy or automatically waive protections.”12 A day earlier, the Texas Business Court had reached a similar conclusion under the Texas work product rule, though with rather more teeth in the details.13

III.Who Held the Pen

What seems like a split is just a misreading of the opinions. Every litigant whose AI conversations were protected was representing themselves, or was a non-lawyer party principal doing the work a lawyer would otherwise have done.14 When you’re pro se, your own preparation is your work product, because there’s nobody else’s to be had. Rule 26(b)(3) protects material prepared “by or for another party or its representative.” The chatbot is a pen. Historically, drafting a case theory into a notebook would not have waived anything, and Patti’s “tools, not persons” maintains that view (now a notebook with a subscription attached).

Heppner was in a different position entirely. He had counsel and he didn’t ask them. He directed his questions to a website, and he did it on his own initiative rather than at their direction.15 The material didn’t reflect his lawyers’ thinking because his lawyers hadn’t been involved in producing it. The variable that decides these cases turns out to be whether a lawyer was directing the work, rather than anything about the tool or even about the confidentiality of the terms.

Which is a doctrine we already have a name for. Rakoff said so himself: “Had counsel directed Heppner to use Claude, Claude might arguably be said to have functioned in a manner akin to a highly trained professional who may act as a lawyer’s agent within the protection of the attorney-client privilege. Cf. United States v. Kovel.”16

Kovel is the 1961 case that extends privilege to a third party whose help is “necessary, or at least highly useful, for the effective consultation between the client and the lawyer.”17 It was written about an accountant, it’s been stretched to psychiatrists, patent agents, jury consultants and public relations firms, and there is no obvious reason it stops at software. A federal court protected AI prompts crafted by counsel as opinion work product as early as August 2024 (in part, at any rate, since the same order sent the plaintiffs’ successful test results over to the other side), which is the same idea approached from the other side.18

So the emerging rule, such as it is, looks less like “AI conversations are or aren’t privileged” and more like the oldest rule in the book. Privilege follows the lawyer. It has never before attached to a technology, and it doesn’t appear to be about to start.19

IV.Use It (Wrong) and Lose It

Still, getting the protection is only half the story. The music publishers suing Anthropic found this out in 2025. They had used AI in their own investigation, and the question of what they had to hand over came back to the same court twice. In May the court found a limited waiver over the roughly five thousand prompt-and-output pairs the publishers had already disclosed and relied on, and refused to order up the undisclosed rest, since a waiver has to stay “closely tailored … to the needs of the opposing party.”20 In December it held that even the failed pre-suit prompts were attorney work product, and then ordered the post-suit ones produced anyway, because the publishers had indicated their investigators would be testifying about how the investigation was done.21 Two opposite results inside a single order. The difference had everything to do with what the party did with the material rather than how the material was created.

A New York trial court had got there faster (and more painfully). Counsel disclosed part of a ChatGPT transcript during a deposition, and the court held that this put the transcript at issue and ordered the entire exchange produced.22 Anyone who has watched a privilege log unravel will recognize the mechanic, which is the same one that applies to internal investigations and validation studies and every other document a party would like to describe without handing over.

Even the Texas decision (which gets written up almost everywhere as a clean win) ordered production of all the discovery material and work product that had been fed into ChatGPT in the first place.23 Your prompts are, among other things, an inventory of what you were holding when you wrote them.

V.Login As

Rakoff didn’t rule that AI conversations can never be confidential. He ruled that these ones weren’t, and he got there by reading the terms Heppner had agreed to when he created his account.24 Those were consumer terms, and Anthropic’s consumer privacy policy says inputs and outputs may be used for training unless you opt out, that safety-flagged conversations are used regardless, and that data may be shared with government authorities on a good-faith belief that disclosure is reasonably necessary to comply with legal process.25 It also says that it doesn’t apply to content processed on behalf of business customers.

The commercial tiers are a materially different document. OpenAI’s business, enterprise, education and API terms state that customer data isn’t used for training by default, with customer-controlled retention and zero data retention available for qualifying use cases; Anthropic’s commercial offerings run on configurable retention with audit logging. When Judge Wang ordered OpenAI to preserve output logs in the New York Times litigation in May 2025, the order as written reached everything, expressly including data that would otherwise have been deleted at a user’s request or under privacy law. The carve-outs for Enterprise, Edu and zero-retention API customers arrived weeks later.26 The same conversation, typed by the same person on the same afternoon, sits in a different legal posture depending on which account they were signed into.

Sam Altman said the quiet part out loud twice in the summer of 2025, first calling for something like an “AI privilege” and then telling a podcast audience that there’s no legal confidentiality for user conversations and that if OpenAI were sued it would be legally required to produce them today (he added that he thought this was very screwed up).27

And the same procurement decision answers a second question that has nothing to do with litigation at all. In January, Judge Tigar dismissed a trade secret claim on the ground that “[b]y developing her ideas through ChatGPT, [the plaintiff] voluntarily disclosed the existence of her ideas to OpenAI; whether she owned those ideas notwithstanding the disclosure is not relevant.”28 The reasoning runs back through Ruckelshaus v. Monsanto: the property right in a secret is extinguished once you disclose it to someone under no obligation to protect it.

Nobody should build a compliance program on that case. It was a pro se complaint, the analysis only runs to about two paragraphs, it was dismissed with prejudice, and the appeal was thrown out for failure to prosecute rather than decided on the merits.29 It is also, at least for now, the only decision on the point.

The reasoning turns on the recipient being under no obligation of confidentiality. Commentators have drawn the obvious inference (that enterprise terms carrying confidentiality obligations and retention controls might well amount to the “reasonable measures” the statute requires) though no court has yet said so. Privilege only becomes relevant once you’re in a fight, whereas trade secret status is something you either have or don’t have.

VI.Lawyer in the Loop

None of these decisions is binding on anyone much. One district court opinion, two magistrate orders, a New York trial court and a Texas business court. There’s no appellate authority and a fair amount of daylight between them.30 Anyone telling you the law here is settled probably hasn’t read it.

And yet a working principle falls out of them fairly cleanly. Protection attaches to arrangements, not to tools. If a lawyer scoped the work, engaged the participants and directed the analysis, the arrangement looks like Kovel and there’s something to argue. If someone in the business opened a tab and started thinking out loud, there’s nothing to argue about, and the fact that they later forwarded the output to legal doesn’t change it. That’s what the alchemy line means. It’s the same principle that says a memo doesn’t become privileged by being cc’d to counsel, now applied to a chat window.

What’s new is the volume. The number of people in a large company who might, in a given week, work through a commercially sensitive problem with a model is increasing by the day. Some of that is happening on consumer accounts. Much like other chat logs, there’s a fair portion of it that involves material no one would like to read back in a deposition transcript. And unlike the bias testing we wrote about earlier this month (which at least somebody chose to commission) none of this was ever a decision anybody made.31

The fix is the arrangement Rakoff’s opinion outlines in the negative (rather than a new privilege Congress hasn’t written): the right tier, an engagement that runs through counsel, and a record of who directed what. In practice that means the commercial tier (rather than whatever someone signed up for at home), a scope that counsel wrote (rather than one they were shown afterwards), and sufficient logging to demonstrate the sequence a year later to somebody inclined to doubt you.32

We built Privlex so that the useful work (the analysis, the modelling, the thinking out loud) can happen inside an arrangement that holds up, rather than being discouraged because nobody is certain it’s safe.33 The companies getting this right are using AI more rather than less, with concerns about privilege managed before anyone types anything.

Let us build you the arrangement that holds, so nobody on your team has to guess whether it was safe to ask.