Sharing Information With AI Agents: How Clients May Unwittingly Waive Privilege In Third Party Communications

Artificial Intelligence presents us with seemingly endless possibilities of innovative ways to transform how we live and work. But even when the sky could be the limit, courts can deliver rulings designed to keep us grounded, temper expectations, and remind us that there may be significant legal consequences if we believe our interactions with AI are equivalent to those with other human beings.

In this blog post, I explore United States v. Heppner, a landmark decision that can serve as a practical reminder for the Canadian legal community and our clients: core privilege and confidentiality provisions that protect lawyer-client communications tend to be waived if disclosure extends to third parties without protection.

Lawyer-Client Privilege: A Refresher.

Lawyer-client privilege (known as attorney-client privilege south of the border) is the oldest evidentiary privilege found in common law. First established as a privilege which protected the honour of an officer of the court from divulging secrets, it developed into a privilege designed to allow clients, indeed to encourage clients, to make full disclosure to a recognized professional to facilitate the seeking and dispensing of legal advice and representation. 

This privilege protects communications, made in confidence, between a client and a lawyer or an agent acting at the lawyer’s direction for the purpose of legal advice. Materials prepared in anticipation of litigation by or at the direction of counsel are also privileged under work-product protection.

Lawyer-client privilege is relational. For communication to be considered privileged, both the relationship (between client and lawyer) and purpose of the communication must meet certain criteria. If or when such confidences are shared with a third party outside the protected relationship, privilege is usually deemed to be waived unless covered by carefully structured exceptions, including limited‑purpose disclosure, confidentiality agreements, and joint‑defense agreements (the latter allowing multiple parties who share a common legal interest to cooperate in their defense while preserving attorney-client privilege).

A third-party generative AI assistant is not a lawyer (or, necessarily, a lawyer’s agent or work product).

Anthropic’s AI platform “Claude” may share a name with some practicing lawyers, but unlike them, this generative AI assistant has not achieved the credentials required to engage in privileged lawyer-client communication. 

In October 2025, Bradley Heppner, having received a grand jury subpoena, consulted with his attorney about anticipated charges relating to alleged misconduct involving several corporate entities. Following these discussions, Heppner proceeded to engage with the Claude platform in order to prepare reports outlining potential defense strategies with respect to certain facts and applicable laws.

Significantly, although some of the information Heppner fed to Claude derived from what would be considered privileged lawyer-client communications, Heppner’s attorney had not suggested or directed him to run Claude searches.

After Heppner’s arrest on November 4, 2025, FBI agents executed a search warrant at his home and recovered, among other items, 31 documents that memorialize communications Heppner had with Claude. The U.S. government moved for a ruling that these AI-generated documents are neither protected by attorney-client privilege, nor the similar but distinct work product doctrine.

Heppner’s attorney argued these documents were covered by privilege because:

• Information that was input into Claude included what he had told his client;
• The AI document was created for the purpose of consulting with counsel to obtain legal advice; and
• The AI documents were subsequently shared with counsel.

In his February 10, 2026 ruling, Judge Rakoff of the Southern District of New York first noted that courts construe attorney-client privilege narrowly, and “in the absence of an attorney-client relationship, the discussion of legal issues between two non-attorneys (Heppner and Claude) is not protected by attorney-client privilege. Because Claude is not an attorney, that alone disposes of Heppner’s claim of privilege”. He also clarified that although some commentators consider Claude to be a tool similar to other Internet-based software, such as cloud-based word processing applications, “the use of such applications is not intrinsically privileged in any case…”.

Second, Judge Rakoff wrote that the information contained in the AI-generated documents was not confidential, not only because Heppner communicated with a third-party platform, but also because of Anthropic’s own written privacy policy. Claude’s users consent to the company’s right to disclose personal data to third parties, including governmental regulatory authorities, “in connection with claims, disputes[,] or litigation.” For these reasons, the judge determined Heppner had no reasonable expectation of confidentiality when communicating with Claude.

Third, the judge noted that Heppner had not communicated with Claude for the purpose of obtaining “legal advice”, but rather used it of his own volition and without direction from his attorney. Judge Rakoff highlighted that when the United States government asked the platform if it could provide legal advice, Claude explicitly replied: “I’m not a lawyer and cannot provide formal legal advice or recommendations.”

Finally, the judge stated “it is black-letter law that non-privileged communications are not somehow alchemically changed into privileged ones upon being shared with counsel”. 

Turning to the distinct-but-related work product doctrine, the judge explained that “materials prepared by or at the behest of counsel in anticipation of litigation or for trial” may be provided qualified protection. However, this doctrine is generally not applied to shield materials from discovery that were not prepared by an attorney or their agents.

Even if the AI-generated documents were prepared in anticipation of a trial, the judge noted they are not protected because their creation was not at the behest of counsel, nor did they reflect counsel’s strategy at the time they were produced.

In his concluding remarks, while acknowledging generative AI as a new frontier in the ongoing dialogue between technology and the law, the Judge Rakoff stressed that “AI’s novelty does not mean that its use is not subject to longstanding legal principles and the work product doctrine”.

Practical Implications for Confidentiality, Privacy, and Privilege.

While Heppner is a U.S. federal‑court decision, and one that has not escaped criticism, its reasoning is consistent with long‑standing Canadian common‑law principles: privilege attaches to confidential communications between client and lawyer, and disclosure to third parties without having engineered protections prior to disclosure, runs the risk of waiver of the privilege. 

Therefore, Ontario lawyers and clients should see this decision as a practical reminder that reinforces the importance of taking reasonable precautions, and not as a doctrinal shift.

1. AI tools and client confidences

Highly sensitive facts, client‑specific strategy, or privileged inputs should not be entered into large‑language‑model platforms (public‑facing chat interfaces) unless you have carefully vetted privacy terms and implemented contractual safeguards and internal protocols. If counsel directs a client to use a specific AI tool under a controlled, confidential arrangement, there may be a better argument for preserving confidentiality or work‑product status, but this remains fact‑specific and not automatic.

2. Document‑drafting workflows

Privilege still attaches to the lawyer’s own work products (memos, fact‑memos, draft pleadings, or strategy notes) if they are created by counsel, for litigation, and kept confidential. But if a client first drafts sensitive strategy or factual analyses using a public AI tool (or an unsecured cloud tool), and that material is never “owned” by counsel or kept within a controlled environment, it may be discoverable and unprotected even if counsel later edits or relies on it.

3. Client instructions and training

Counsel must explicitly warn clients against using public AI tools for confidential or legally sensitive matters, and/or forwarding AI‑generated drafts or chat histories to third parties without counsel’s review and approval. Consider including AI‑use protocols in engagement letters or information‑security letters that define approved tools and channels, and specify how confidential information can and cannot be stored or transmitted.

4. Privacy and data‑security hygiene

Confidentiality and “reasonable expectation of confidentiality” are now tightly linked to the terms of service and privacy policies of third‑party platforms and how these tools are configured. Key elements to consider include whether logs are retained, if training‑data re-use is permitted, whether outputs might be shared with others, and if data involves cross-border transfer of personal or confidential information. It is advisable to verify that vendors provide adequate contractual obligations regarding data confidentiality, deletion, and access‑controls.

How to reduce exposure in practice:

• Keep all privileged strategy and legal analysis in channels controlled by counsel (firm‑managed email, secure case management systems, encrypted workspaces) and avoid copying privileged or work product material into public AI interfaces or unsecured cloud tools.
• If using AI tools, choose enterprise‑grade or contractually locked‑down instances with explicit prohibitions on using inputs for training or sharing with third parties.
• Strip out client‑specific identifiers or sensitive facts before testing hypotheticals in AI.
• Check‑and‑balance: When a client says they “worked with an AI platform” on a draft, treat the underlying AI‑prompting as potentially non‑privileged unless demonstrably done under counsel’s direction within a confidential, controlled environment.

Final Thoughts.

While the Heppner decision offers lawyers a timely and enticing invitation to review our own protocols for confidentiality and privileged communication in the age of AI, it will hardly be the last time courts are asked to grapple with questions involving AI agents and discoverability. 

As this technology continues to evolve and more AI users develop their own personalized relationship with Claude or similar AI agents, there may be a greater risk that they ultimately reveal sensitive information that may be exploited by an adversary. When people feel as though they are having a private conversation with a friend, or therapist, or assistant, they may lose sight of the reality that they are potentially creating a verbatim record that could one day become a courtroom exhibit.