Perry Machine and the Case of the Privileged Prompt – Courts Consider Whether AI Legal Advice is Privileged
Every communications technology arrives in the legal profession as an existential threat to privilege.
When lawyers first began using email, courts and bar associations openly questioned whether confidential legal advice could survive transmission through systems operated by third parties. Some ethics opinions warned that ordinary email might be too insecure for privileged communications. Others concluded that email was simply the digital equivalent of a telephone call or mailed letter. Eventually, courts adopted a pragmatic rule: Privilege did not disappear merely because communications traveled electronically, so long as lawyers used reasonable precautions to preserve confidentiality.
Cloud computing triggered the same anxiety. Could privileged documents remain protected if they were stored on servers owned by Microsoft, Google, Amazon or a litigation-support vendor? Again, the answer evolved from categorical fear to functional analysis. The issue was not the technology itself, but whether counsel exercised reasonable care, imposed confidentiality obligations and maintained control over client information.
Online legal research produced a quieter version of the same problem. A lawyer’s search history can reveal litigation strategy, legal theories and factual concerns. Yet courts did not hold that using Westlaw or Lexis waived privilege merely because third-party infrastructure processed the searches.
Now, artificial intelligence has arrived at the same crossroads.
Generative AI
The first real federal split over whether generative AI use waives privilege emerged in February 2026, when two federal courts reached sharply different conclusions about AI-assisted litigation materials. One court held that AI-generated documents were not protected because the user disclosed information to a non-lawyer third party. The other held that AI-assisted litigation preparation remained protected work product even for a pro se litigant.
The cases are United States v. Heppner, No. 25 Cr. 503 (JSR) (S.D.N.Y. Feb. 17, 2026), and Warner v. Gilbarco, Inc., No. 2:24-cv-12333 (E.D. Mich. Feb. 10, 2026). Together, they establish the first meaningful doctrinal framework for AI privilege disputes.
But the real lesson of the cases is that lawyers often conflate two entirely different protections: Attorney-client privilege and attorney work product.
Those doctrines overlap, but they are not the same thing.
Attorney-client privilege protects confidential communications between attorney and client made for the purpose of obtaining or providing legal advice. The doctrine exists to encourage candor between lawyer and client. It is fundamentally relational. It generally requires a lawyer — or someone acting as the lawyer’s necessary agent — to participate in the communication. See Upjohn Co. v. United States, 449 U.S. 383, 389–97 (1981); United States v. Kovel, 296 F.2d 918, 921–22 (2d Cir. 1961). So to be privileged, there must be a lawyer or – and this may be important – an “agent” of a lawyer.
Work-product protection is different. It protects materials prepared in anticipation of litigation by or for a party or its representative. Fed. R. Civ. P. 26(b)(3). The doctrine protects legal strategy, interviews, chronologies, research, witness analyses, legal theories and attorney mental impressions. Unlike attorney-client privilege, it is not limited to communications with a lawyer. And unlike attorney-client privilege, work product can sometimes survive disclosure to third parties if the disclosure does not materially increase the likelihood that adversaries will obtain the material. So work product protects materials not created by a lawyer if created in anticipation of or in assistance of litigation.
SEC Defendant – Heppner
In Heppner, the Southern District of New York considered whether materials generated by criminal defendant Bradley Heppner using Anthropic’s Claude AI platform were protected from government inspection under either attorney-client privilege or the work-product doctrine.
Heppner had been indicted for securities fraud, wire fraud and conspiracy relating to alleged false statements to auditors and falsification of corporate records involving GWG Holdings, Inc. After the FBI executed a search warrant at his home and seized electronic devices, defense counsel informed the government that some of the seized materials were approximately thirty-one memorized “reports” generated through conversations between Heppner and Claude.
According to the opinion, Heppner began communicating with Claude after receiving a grand jury subpoena and after discussions with the government made clear that he was the target of the investigation. He used Claude to outline defense strategy, discuss facts and identify arguments he anticipated the government might bring. Defense counsel argued that the documents were privileged because Heppner input information learned from counsel, created the reports to obtain legal advice and later shared the outputs with counsel.
Judge Rakoff rejected both privilege theories.
First, the court held that the communications were not protected by attorney-client privilege because Claude was not an attorney and no attorney-client relationship existed between Heppner and Anthropic’s AI system. The court emphasized that communications with non-attorneys generally are not privileged and noted that Claude itself expressly disclaimed providing legal advice.
Second, the court held that the communications were not confidential. Judge Rakoff pointed directly to Anthropic’s privacy policy, which stated that Anthropic could collect user inputs and outputs, use them to train models and disclose information to third parties in response to legal process. Because users were warned that their information could be retained and disclosed, the court concluded that Heppner lacked a reasonable expectation of confidentiality.
Third, the court rejected Heppner’s argument that Claude functioned like an agent assisting counsel under Kovel. Judge Rakoff distinguished accountants and litigation-support agents retained to facilitate legal advice from an independently operated public AI platform that the defendant used on his own initiative without direction from counsel.
The work-product claim failed for related reasons. The court acknowledged that the materials were created in anticipation of litigation, but held that they were not prepared by or at the direction of counsel and did not reveal counsel’s litigation strategy. Instead, the materials reflected Heppner’s own independent use of Claude. Judge Rakoff emphasized that defense counsel admitted they did not direct Heppner to use Claude and that the AI-generated materials were prepared solely on Heppner’s own initiative.
The court therefore ordered production.
Warner Distinguished
Warner came out differently because the underlying doctrine was different. Warner involved a pro se employment-discrimination plaintiff who used ChatGPT in connection with her litigation against Gilbarco and related defendants. During discovery, defendants sought production of “all documents and information concerning her use of third-party AI tools in connection with this lawsuit.” They also argued that any work-product protection had been waived because plaintiff used ChatGPT.
Magistrate Judge Anthony Patti rejected the request. Unlike Heppner, Warner did not primarily involve attorney-client communications. The plaintiff was proceeding pro se. There was no claim that ChatGPT itself became the plaintiff’s attorney. Instead, the issue was whether the plaintiff’s AI-assisted litigation preparation constituted protected work product. The court held that it did.
Judge Patti emphasized that Rule 26(b)(3) protects litigation-preparation materials created by or for a party, including pro se litigants. The court specifically noted that “a pro se litigant has a right to assert work product protection over such material.” The court also distinguished waiver of the attorney-client privilege from waiver of work product. Voluntary disclosure to a third party may waive attorney-client privilege, but a work-product waiver generally requires disclosure to an adversary or conduct substantially increasing the likelihood that an adversary will obtain the material.
Critically, the Warner court treated ChatGPT as a tool rather than a person. “ChatGPT (and other generative AI programs) are tools, not persons,” the court wrote. Defendants were effectively attempting to discover the plaintiff’s thought processes, litigation theories and internal drafting methods merely because she used software to assist with drafting and analysis. The court characterized the request as an improper fishing expedition seeking access to the plaintiff’s internal mental impressions.
The court therefore denied the motion to compel. At first glance, the decisions appear irreconcilable. They are not.
Heppner was fundamentally an attorney-client privilege case involving disclosure of information to an external AI platform that was neither counsel nor counsel’s agent. Warner was fundamentally a work-product case involving a litigant’s protected litigation-preparation process.
A client who pastes legal advice into a public chatbot may indeed waive attorney-client privilege because the communication is no longer confidential and is no longer limited to lawyer and client.
But a litigant’s internal litigation preparation may still constitute protected work product even if software assists the drafting process. A lawyer does not waive work product merely by using Microsoft Word, Grammarly, Lexis, Westlaw, Relativity or an e-discovery analytics engine. The Warner court essentially concluded that generative AI can function similarly when used as a drafting or research aid.
The harder cases will fall somewhere between Heppner and Warner.
Suppose outside counsel uses a locked-down enterprise AI platform subject to a no-training agreement, confidentiality restrictions, access controls and legal supervision. Is the platform closer to a litigation-support vendor or closer to a public stranger? Suppose the AI system is privately hosted by the law firm itself. Suppose the prompts contain privileged communications from clients. Suppose the AI outputs contain attorney’s mental impressions. Suppose the system retains prompts but does not train on them. Suppose the vendor contract prohibits disclosure.
These are no longer hypothetical questions. The December 1, 2025, amendments to Federal Rules of Civil Procedure 16 and 26 effectively force litigants to confront them at the outset of every federal case. Parties must now address privilege issues, privilege-log timing and ESI treatment earlier in the litigation process. See Fed. R. Civ. P. 16, https://www.law.cornell.edu/rules/frcp/rule_16; Fed. R. Civ. P. 26, https://www.law.cornell.edu/rules/frcp/rule_26.
That means AI governance now belongs in Rule 26(f) conferences, ESI protocols and protective orders. Lawyers using AI in litigation should already be implementing several baseline controls.
First, they should prohibit clients, witnesses and employees from uploading privileged communications, confidential investigations or legal analyses into consumer-grade AI systems.
Second, they should distinguish enterprise AI tools from public chatbots. Vendor contracts should expressly prohibit training on client data, require confidentiality, mandate segregation of customer data and provide deletion rights.
Third, they should use Federal Rule of Evidence 502(d) claw-back orders specifically tailored to AI-assisted review workflows. See Fed. R. Evid. 502(d).
Fourth, protective orders should expressly regulate AI usage involving discovery materials, trade secrets, personal information and privileged content.
Fifth, firms should create internal policies governing prompt engineering, human review, validation, retention and AI-assisted legal drafting.
Finally, lawyers should remember that AI is not itself the legal problem. Disclosure is.
Email did not destroy privilege. Cloud computing did not destroy privilege. Online legal research did not destroy privilege. AI will not destroy privilege either.
But AI changes the mechanics of disclosure. A lawyer can now reveal privileged information to a third party instantly, conversationally and at machine scale, often without fully understanding where the information goes, how long it is retained, whether humans can review it or whether it will later reappear in response to another user’s query.
That is why the real divide after Heppner and Warner is not between “AI protected” and “AI unprotected.” The real divide is between AI systems treated as supervised legal infrastructure and AI systems treated like magic toys.
The problem is not the robot. The problem is who you told your secrets to.
