By Michael Langan, Mia Herrera, and Tara Nugent[1]
Courts and commentators have both begun to grapple with whether the use of generative artificial intelligence (“gen-AI”) waives attorney-client privilege and/or work product protection. So far this year, federal district courts have addressed two issues regarding litigants’ use of gen-AI tools: (1) whether a pro se plaintiff’s use of a gen-AI tool waives work product protection over the tool’s inputs and outputs; and (2) whether a counseled criminal defendant’s undirected use of a gen-AI tool waives work product protection and/or attorney-client privilege over the tool’s inputs and outputs. The first issue was answered in the negative by two courts (in the Eastern District of Michigan and the District of Colorado), while the second issue was answered in the affirmative by one court (in the Southern District of New York).
The Southern District of New York’s decision – United States v. Heppner – has drawn criticism from two supporters of the responsible use of gen-AI in the legal practice: Bridget Mary McCormack (co-host of the podcast “AI and the Future of Law,” President and CEO of the American Arbitration Association, and former Chief Justice of the Michigan Supreme Court) and Shlomo Klapper (founder and CEO of Learned Hand, a gen-AI platform built exclusively for courts, prior Second Circuit law clerk, and prior associate at Quinn Emanuel). Bridget Mary McCormack and Shlomo Klapper, The Machine Isn’t the Interlocutor: Why United States v. Heppner Gets Privilege Wrong, 27 Sedona Conf. J. 1 (Apr. 2026).
However, several aspects of McCormack and Klapper’s analysis merit closer examination.
Whether a Pro Se Plaintiff’s Use of a Gen-AI Tool Waives Work Product Protection
In mid-February, in the case of Warner v. Gilbarco, the Eastern District of Michigan found that a pro se plaintiff’s disclosure of confidential information to gen-AI tools did not waive the work product protection over the tools’ inputs and outputs. Warner v. Gilbarco, Inc., 820 F. Supp. 3d 629 (E.D. Mich. 2026). The plaintiff used gen-AI tools, including ChatGPT, to prepare litigation materials relating to her claims of employment discrimination. The defendants moved to compel production of those AI-assisted litigation materials, arguing that the plaintiff waived work-product protection by inputting information into gen-AI platforms. The court denied the motion. The court reasoned that the plaintiff’s AI-assisted materials were protected work product because they were prepared in anticipation of litigation.[2] The court further reasoned that using such gen-AI tools did not constitute third-party disclosure sufficient to waive protection, because such disclosure must be “to an adversary or in a way likely to get in an adversary’s hand,” and gen-AI programs are “tools, not persons, even if they may have administrators somewhere in the background.” Warner, 820 F. Supp. 3d at 636-37 (emphasis in original).
Six weeks later, in the case of Morgan v. United States Steel Corp., the District of Colorado agreed with Warner’s reasoning in rendering a similar finding. Morgan v. V2X, Inc., No. 1:25-cv-01991, 2026 WL 864223 (D. Colo. Mar. 30, 2026). In Morgan, a pro se plaintiff used gen-AI tools to prepare litigation materials (specifically to review evidence) relating to his claims of employment discrimination. The defendant moved to compel the disclosure of the identity of the gen-AI tools that the plaintiff had used, arguing that disclosure was necessary to determine whether the defendant’s confidential information had been compromised through the plaintiff’s use of gen-AI tools (in violation of the parties’ Protective Order). The court granted the motion in part and denied it in part. More specifically, the court granted the motion to the extent that it requested an order compelling the plaintiff to disclose the identity of the gen-AI tool(s) he used so that the defendant could assess whether adequate confidentiality safeguards existed to protect the defendant’s confidential information.[3] Otherwise, the court denied the defendant’s motion. In doing so, the court reasoned that Fed. R. Civ. P. 26(b)(3) protects a pro se litigant’s litigation-preparation materials, including mental impressions, conclusions, opinions, and legal theories developed through the use of gen-AI tools. It further reasoned that a pro se litigant’s use of gen-AI tools does not automatically waive work-product protection because, “even though AI use technically ‘discloses’ information to a third party, it is highly unlikely the information will fall into the hands of an adversary absent some legal process to compel it.” Morgan, 2026 WL 864223, at *5 (citing Warner for the proposition that gen AI programs are “tools, not persons”).
Whether a Counseled Criminal Defendant’s Undirected Use of a Gen-AI Tool Waives Work Product Protection and/or Attorney-Client Privilege
Meanwhile, a week after the issuance of Warner, in the case of United States v. Heppner, the Southern District of New York found that a counseled criminal defendant’s undirected inputting of privileged information into a gen-AI tool waived both the work product protection and attorney-client privilege protection over the tool’s inputs and outputs. United States v. Heppner, 820 F. Supp. 3d 292 (S.D.N.Y. 2026). The defendant, represented by counsel at Quinn Emanuel, was the target of a federal criminal securities-fraud investigation. Undirected by counsel, he used Anthropic’s gen-AI platform, Claude, to prepare 31 documents analyzing his legal exposure, possible defenses, and litigation strategy. In doing so, both the prompts and outputs incorporated information that the defendant had received from counsel. Federal agents later seized the AI-generated materials, and the defendant asserted attorney-client privilege and work-product protection over them. The Government moved for a ruling that the defendant’s AI-generated materials were not protected by the attorney-client privilege or the work-product doctrine because the defendant disclosed protected information to a third-party gen-AI platform. The court granted the Government’s motion and held that the defendant’s use of Claude defeated both attorney-client privilege and work-product protection. In doing so, the court reasoned that the defendant’s interactions with Claude were not privileged attorney-client communications because “the AI documents lack at least two, if not all three, elements of the attorney client privilege.”[4] Specifically, the court found as follows: (1) the AI documents were not communications between the defendant and his counsel (because Claude is not an attorney); (2) the communications memorialized in the AI documents were not confidential (because Claude’s terms of service permit both data collection to “train” Claude and disclosure to third parties including “governmental regulatory authorities”); and (3) the defendant did not communicate with Claude for the purpose of obtaining legal advice (because he did not do so at the direction of counsel). Heppner, 820 F. Supp.3d at 296-97. The court further reasoned that the AI-generated documents were not protected work product because the defendant created them independently, rather than “at the behest of counsel” (the common-law standard governing work product in criminal cases).[5] Heppner, 820 F. Supp.3d at 297-99. However, the Court observed that, “[h]ad counsel directed Heppner to use Claude, Claude might arguably be said to have functioned in a manner akin to a highly trained professional who may act as a lawyer’s agent within the protection of the attorney-client privilege.” Heppner, 820 F. Supp.3d at 297 (citing United States v. Kovel, 296 F.2d 918, 922 [2d Cir. 1961]).
McCormack and Klapper’s Criticism of United States v. Heppner
In their article, “The Machine Isn’t the Interlocutor: Why United States v. Heppner Gets Privilege Wrong,” 27 Sedona Conf. J. 1 (Apr. 2026), Bridget Mary McCormack and Shlomo Klapper criticize Heppner for holding that a criminal defendant waived attorney-client privilege and work-product protection when, without receiving his attorney’s direction to do so, he entered confidential information into Anthropic’s gen-AI platform, Claude, to analyze his legal exposure and defense strategy. Their main point is that the Heppner court “anthropomorphized” Claude by treating it as a human “interlocutor” rather than as a computational tool, and then asking whether the defendant’s interactions with the interlocutor independently satisfy the elements of attorney-client privilege and work product protection. They argue that, by doing so, Heppner fundamentally misunderstood gen-AI and misapplied both the attorney-client privilege and work product protection. The proper analysis, they argue, would have been for Heppner to apply the two-part framework courts have long used when considering confidential material that has been processed through technology: (1) does privilege/protection attach to the information; and (2) if so, did the user’s interaction with the tool waive it?
More specifically, the authors argue that Heppner erred in three principal ways. First, the authors argue that the court incorrectly treated the defendant’s use of gen-AI as disclosure to a third party triggering the waiver of attorney-client privilege. Proposing an alternative “functional approach” to determining whether privilege has been waived, they argue that “[p]rivilege is waived only if a particular technology interaction creates the specific risks the third-party disclosure rule was designed to address: [1] testimony, [2] compelled production, and [3] volitional disclosure by a recipient with independent legal standing.” McCormack & Klapper, The Machine Isn’t the Interlocutor, at 3. They argue that Claude cannot testify, decide to reveal confidences, or volitionally disclose information, nor can it even truly “receive” confidential information. Id. at 6. Rather than being analogous to communicating with another person, they argue, using Claude is more analogous to using cloud-based word-processing software.
Second, the authors criticize Heppner’s confidentiality analysis. Because Heppner relied heavily on the fact that Anthropic’s terms of service permit data collection and potential disclosure, the authors argue that Heppner has departed from decades of authorities holding that the use of cloud-based technology does not itself destroy confidentiality merely because a service provider technically processes or stores data. In support of this argument, they cite, among other authorities, ABA Formal Opinion 477R (May 11, 2017), which reasons that a service provider’s technical capacity to access data does not constitute third-party “disclosure.” Id. at 8-9.
Third, the authors criticize Heppner’s work-product analysis. Because Heppner applied the common-law standard governing work product in criminal cases in the Second Circuit (which protects materials prepared “by or at the behest of counsel”), the authors argue that Heppner improperly narrowed the work-product doctrine and incorrectly rejected authorities such as Shih v. Petal Card, Inc., 565 F. Supp. 3d 557 (S.D.N.Y. 2021), which recognized work-product protection for materials prepared by litigants themselves in anticipation of litigation. Id. at 11-13.
Evaluation of McCormack and Klapper’s Criticism
To be clear, McCormack and Klapper raise several important points. For example, their article correctly points out that gen-AI systems’ terms of service permitting data access and potential government disclosure are similar to the terms of service of traditional cloud-based service providers, which have been found not to destroy confidentiality. Nevertheless, reasonable readers may question whether the authors’ proposed “functional approach” to defining the nature of a third-party capable of waiver in fact requires a result contrary to the result in Heppner, or even whether the approach fully accounts for the unique and varying characteristics of contemporary gen-AI systems, not to mention legal constraints imposed by existing precedent. In particular, there are three areas in which McCormack and Klapper’s analysis is reasonably open to question.
Area 1: Possible Misapplication of the “Functional Approach”
First, it is not clear that the “functional approach” advocated by the authors in fact requires a finding of no third-party disclosure under the circumstances of Heppner. The article does not appear to cite authority specifically supporting the assertion that “the specific risks [that] the third-party disclosure rule was designed to address” were “[1] testimony, [2] compelled production, and [3] volitional disclosure by a recipient with independent legal standing.” McCormack & Klapper, The Machine Isn’t the Interlocutor, at 3, 11, 17, 18. Granted, in support of their more-general assertion that the “specific reason” for the “third-party disclosure rule” is “when confidential information is shared with a person, that person may recall the communication, choose to disclose it further, or be compelled to testify about it,” the authors cite Restatement (Third) of the Law Governing Lawyers § 79 (Am. L. Inst. 2000). Id. at 6, n.20.
Assuming that Section 79 of the Restatement supports this more-general assertion, Claude appears to carry at least one of these three risks: the risk of voluntary further disclosure.[6] Anthropic states that “we train our models using data from the following sources: . . . [d]ata that our users or crowd workers provide, including Inputs and Outputs from our Services (unless users opt out) . . . .” Anthropic, Privacy Policy (Jan. 12, 2026), https://www.anthropic.com/legal/privacy (last visited June 8, 2026). Similarly, Anthropic acknowledges the following two facts: (1) part of its “pre-training” of a new model is the conversion of “large amounts of content (including text)” into “tokens” and the processing of this content in order to “build[] a complex network of relationships between tokens”; and (2) part of its “post-training” of an existing model is “fine-tuning,” which “provides the model with the examples of appropriate outputs (e.g., specific to a particular domain or use case)” in order to “help[] improve the model.” Anthropic, Non-User Privacy Policy (Aug. 28, 2025), https://www.anthropic.com/legal/non-user-privacy-policy (last visited June 8, 2026).[7] In other words, Anthropic’s policies indicate that user inputs may be used to fine-tune an existing model of Claude or train a new model of Claude.
Granted, the authors assert that “[n]o human reads the privileged communication during training; no identifiable version is stored in retrievable form; no one outside the organization gains access to it.” McCormack & Klapper, The Machine Isn’t the Interlocutor, at 10. However, again, the article does not appear to identify a specific authority for this proposition. See generally id. True, Anthropic states that its “[m]odels do not store text like a database,” and “they do not have access to or pull from the original training data once the models have been trained.” Anthropic, Non-User Privacy Policy. However, this Policy does not expressly state that Anthropic’s models (regardless of their lack of power to “pull from” training data) are incapable of reproducing portions of material contained in their training data.
That omission appears noteworthy because researchers have repeatedly demonstrated that large language models can, in some circumstances, reproduce portions of their training data, particularly distinctive or duplicated content. See, e.g., Milad Nasr et al., Scalable Extraction of Training Data from (Production) Language Models, arXiv:2311.17035 (Nov. 28, 2023), https://arxiv.org/abs/2311.17035 (last visited June 8, 2026) (demonstrating that, under certain circumstances, memorized training data can be extracted from Pythia, GPT-Neo, LLaMA, Falcon, and ChatGPT); Nicholas Carlini et al., Quantifying Memorization Across Neural Language Models, Int’l Conf. on Learning Representations (Mar. 6, 2023), https://arxiv.org/abs/2202.07646 (last visited June 8, 2026) (reporting memorization and verbatim emission of training data in GPT-2-, OPT-, and T5-based models); Nicholas Carlini et al., Extracting Training Data from Large Language Models, 30th USENIX Security Symposium (June 15, 2021), https://arxiv.org/abs/2012.07805 (last visited June 8, 2026) (demonstrating that GPT-2 could be induced to reproduce verbatim portions of its training data, including names, phone numbers, and email addresses). More recently, researchers have reported similar phenomena in proprietary frontier models, including Claude. See Ahmed Ahmed et al., Extracting Books from Production Language Models, arXiv:2601.02671 (Jan. 6, 2026), https://arxiv.org/abs/2601.02671 (last visited June 8, 2026) (reporting that substantial portions of copyrighted text could be extracted from Claude 3.7 Sonnet, GPT-4.1, Gemini 2.5 Pro, and Grok 3 under certain circumstances).
Accordingly, when a provider incorporates user inputs into model training, there appears to exist at least a theoretical risk that information contained in those prompts could later be reproduced by the model, especially if the information is distinctive or repeatedly encountered during training. For example, if a user entered a highly distinctive factual statement containing an unusual combination of names, places, and events,[8] the literature suggests a theoretical possibility that a later model could reproduce some or all of that distinctive sequence of words in response to another user’s prompt.
Simply stated, although this risk of reproduction of Claude’s inputs might be so small as to be deemed reasonable,[9] it appears difficult to conclude that the risk is literally zero.
Perhaps more importantly, McCormack and Klapper’s article can be casually interpreted as suggesting that contemporary gen-AI systems generally should not be treated as interlocutors for privilege purposes. However, some gen-AI systems that are configured to retain conversational memory across sessions may present a more difficult question, because they might be able to functionally recall and be compelled to produce or disclose their inputs. In response to an objection that this last risk is one of compelled testimony (and not one of compelled production or disclosure), and that a gen-AI model is not capable of testimony because it is not a human, one should consider the question-begging nature of that objection (i.e., a machine cannot be an interlocutor because an interlocutor must be a human). One should also remember that it is a “functional approach” that the authors are advocating, and that compelled production or disclosure appears functionally similar to compelled testimony. Indeed, if one is to insist on using a “functional approach” for determining whether third-party disclosure occurs through the use of gen-AI models, one might reasonably conclude that such models perform some functions traditionally associated with “interlocutors.” See The New Oxford American Dictionary 886 (2001) (defining “interlocutor” as “a person who takes part in a dialog or conversation”). More specifically, rather than merely store, transmit, retrieve, or calculate information, gen-AI systems generate novel conversational responses that often resemble those of human conversants. In fact, their outputs are so generative that some of them are inevitably hallucinatory (that characteristic being a feature and not a bug of their systems).
Area 2: Further Consideration Warranted of the Significance of Model Training
Second, when conducting their confidentiality analysis, the authors equate gen-AI with traditional cloud-based computing services used to store and transmit inputs like Microsoft and Google; however, they overlook how deeply gen-AI uses inputs for model training. Specifically, they argue that “using inputs for model training . . . is not unique to AI. Microsoft and Google reserve functionally identical rights to process content for product improvement, and the court’s reasoning confuses internal computational processing with disclosure.” McCormack & Klapper, The Machine Isn’t the Interlocutor, at 8. However, the article does not fully address whether these product-improvement practices create any risk whatsoever of reproducing prior inputs in outputs to a third party (as presented by gen-AI tools that train on prior inputs). As a result, gen-AI model training may introduce an additional category of risk.
Area 3: Further Consideration Warranted of the Binding Nature of Second Circuit Precedent
Third, the article does not fully address the extent to which the Heppner court was constrained by binding Second Circuit authority. The authors argue that the Heppner court’s “treatment of the governing authority [regarding the work product doctrine in criminal cases] is wrong.” McCormack & Klapper, The Machine Isn’t the Interlocutor, at 11. Specifically, the authors criticize Heppner for rejecting Shih v. Petal Card’s broad “by or for another party or its representative” standard, and following the Second Circuit’s narrower “by or at the behest of counsel” standard, “without recognizing that Shih was governed by Rule 26(b)(3).” Id. at 13 [discussing Shih v. Petal Card, Inc., 565 F. Supp. 3d 557 [S.D.N.Y. 2021]). In doing so, the authors argue, Heppner neglected to “disagree[] with Shih’s reasoning . . . ,” which involved the fact that “[t]he plaintiff in Shih was the party, acting as her own representative, preparing materials in anticipation of litigation she subsequently filed.” Id.
However, regardless of the grounds on which Heppner distinguished Shih, the fact remains that, to reject the narrower requirement that the materials had been prepared “by or at the behest of counsel,” and to follow the broader requirement that the materials had been prepared “by or for another party or its representative,” Heppner would have had to depart from a 23-year-old rule established by the Second Circuit. See In re Grand Jury Subpoenas Dated March 19, 2002, and August 2, 2002, 318 F.3d 379, 383 (2d Cir. 2002) (“The attorney work product doctrine, now codified in Rule 16(b)(2) of the Federal Rules of Criminal Procedure, provides qualified protection for materials prepared by or at the behest of counsel in anticipation of litigation or for trial.”); accord, In re Grand Jury Subpoena Dated July 6, 2005, 510 F.3d 180, 183 (2d Cir. 2007).
In short, under the Heppner court’s reading of existing Second Circuit precedent, it would have been difficult for the court to reach a contrary conclusion without distinguishing or departing from that precedent. See, e.g., Packer on behalf of 1-800-Flowers.com, Inc. v. Raging Capital Mgmt., LLC, 105 F.4th 46, 54 (2d Cir. 2024) (“District Courts, by contrast, are obliged to follow our precedent, even if that precedent might be overturned in the near future. Indeed, we have cautioned District Courts against preemptively declaring that our caselaw has been abrogated by intervening Supreme Court decisions.”).[10]
Conclusion
As courts, practitioners, and ethics authorities continue to confront the implications of generative artificial intelligence, United States v. Heppner is unlikely to be the last word on the waiver of attorney-client privilege and work-product protection. Together, Warner v. Gilbarco, Morgan v. V2X, Inc., and Heppner illustrate that courts are only beginning the difficult task of adapting longstanding doctrines to rapidly evolving technologies. Although reasonable minds may disagree about the proper outcome, the ongoing dialogue among courts and commentators—including McCormack and Klapper’s thoughtful critique of Heppner in the Sedona Conference Journal—provides reason for optimism that the law will continue to evolve toward a fair and efficient result.
[1] Mike is the career law clerk to United States District Judge Glenn T. Suddaby. Mia is a rising second-year law student at Penn State Dickinson Law; and Tara is a rising senior at the University of Maryland. Both Mia and Tara are summer interns in the Chambers of Judge Suddaby. The views expressed in this article do not necessarily reflect the views of Judge Suddaby or any judge in the Northern District of New York.
[2] It is worth noting that the plaintiff’s accompanying attorney-client privilege objection was not expressly evaluated by the court, which reasoned that, “[e]ven if this information were discoverable [due to waiver of any applicable attorney-client privilege], it is subject to protection under the work-product doctrine, which Plaintiff is permitted to assert.” Warner, 820 F. Supp. 3d at 636.
[3] The court also granted the defendant’s motion to the extent that it requested that the parties’ Protective Order be amended to add language that specifically addresses the use of gen-AI tools. It is worth noting that the defendant did not move for the disclosure of the inputs or outputs of the gen-AI tool used by the plaintiff.
[4] In the Second Circuit, the attorney-client privilege attaches to, and protects from disclosure, “communications (1) between a client and his or her attorney, (2) that are intended to be, and in fact were, kept confidential (3) for the purpose of obtaining or providing legal advice.” United States v. Mejia, 655 F.3d 126, 132 (2d Cir. 2011).
[5] In the Second Circuit, the work product doctrine “provides qualified protection for materials prepared by or at the behest of counsel in anticipation of litigation or for trial.” In re Grand Jury Subpoenas Dated March 19, 2002, and August 2, 2002, 318 F.3d 379, 383 (2d Cir. 2003).
[6] The above-stated sentence uses the words “at least one” because, although in its default configuration Claude does not retain inputs and outputs from one session to the next, it is not absolutely clear, from either the Heppner decision or the parties’ briefing of the prosecution’s underlying motion, that the defendant used Claude while it was in its default configuration. If he enabled cross-session memory, then Claude could functionally recall inputs.
[7] Anthropic further explains that “[l]arge language models such as Claude are ‘trained’ on a variety of content such as text, images and multimedia so that they can learn the patterns and connections between words and/or content.” Anthropic, Non-User Privacy Policy. This learning of patterns and connections is achieved through the adjustment of “weights” (or “critical numerical parameters”) in the model’s neural network, which strengthens predictive relationships between tokens. Anthropic, Activating AI Safety Level 3 protections (May 22, 2025), https://www.anthropic.com/news/activating-asl3-protections (last visited June 8, 2026); Anthropic, Decomposing Language Models Into Understandable Components (Oct. 5, 2023), https://www.anthropic.com/news/decomposing-language-models-into-understandable-components (last visited June 8, 2026).
[8] E.g., “Jimmy Hoffa was killed by Colonel Mustard in the library with a lead pipe.”
[9] Potentially weighing against a finding of reasonableness is the fact that, unlike Claude Free (which appears to be the version used by the defendant in Heppner), some versions of Claude, like many versions of other gen-AI models, do not train on user inputs. See, e.g., Anthropic Privacy Center, Is my data used for model training? (Mar. 16, 2026), https://privacy.claude.com/en/articles/10023580-is-my-data-used-for-model-training (last visited June 8, 2026) (“By default, we will not use your inputs or outputs from our commercial products (e.g. Claude for Work, Anthropic API, Claude Gov, etc.) to train our models.”) (emphasis in original).
[10] Also open to question is the article’s assertion that “the [Heppner] court’s claim that the doctrine’s purpose is to protect lawyers’ mental processes, not their clients’ preparation[,] is a new limitation” within the Second Circuit’s framework. McCormack & Klapper, The Machine Isn’t the Interlocutor, at 12. The Heppner court claimed only that the doctrine’s purpose was to protect lawyers’ mental processes (with regard to litigation). Heppner, 820 F. Supp.3d at 298-99 (“[T]he policy animating the work product doctrine . . . is to preserve a zone of privacy in which a lawyer can prepare and develop legal theories and strategy with an eye toward litigation. . . . While it is true that the work product doctrine may apply to materials generated by non-lawyers, the Second Circuit has repeatedly stressed that the purpose of the doctrine is to protect lawyers’ mental processes.”) (citations and internal quotation marks omitted). Furthermore, such a claim does not appear to be a new limitation within the Second Circuit. See, e.g., In re Grand Jury Subpoenas Dated March 19, 2002, and August 2, 2002, 318 F.3d 379, 383 (2d Cir. 2002) (“[T]he principle underlying the work product doctrine . . . [is] sheltering the mental processes of an attorney as reflected in documents prepared for litigation . . . .”).