How do I keep legal advice privileged when my agent talks to my lawyer?

Attorney-client privilege when an AI agent carries your communications with counsel, including the model account it runs on, where advice ends up, and a handling checklist an agent can follow.

Short answer

Privilege can cover communications your agent carries to and from your lawyer, but it is easier to lose than with email. It protects confidential communications between a client and a lawyer made to get legal advice. Three things put it at risk with agents: the model provider seeing the conversation, the agent acting on its own instead of at your direction, and legal advice ending up in places that are widely shared, such as your repository. Each one has a practical fix.

Where privilege is at risk

• The model provider. Your agent's conversation passes through a model provider. Sending a confidential communication to a third party can waive privilege, and courts look at whether you reasonably expected it to stay confidential. Business, enterprise, and API accounts whose terms bar training on your data and promise confidentiality support that expectation. Consumer accounts that allow training or human review weaken it. Courts haven't settled how waiver applies to AI providers, so treat good account terms as reducing the risk, not as a guarantee.
• Who is directing the agent. Privilege belongs to the client. Your agent is safest treated as your means of communicating with counsel, used at the direction of a person with authority, for the purpose of getting legal advice. An agent researching legal questions on its own, with no lawyer involved, is not communicating with a lawyer at all. In United States v. Heppner (S.D.N.Y. 2026), a criminal defendant used a publicly available AI chatbot on his own, without his lawyers' direction, to analyze his exposure and prepare defense materials. The court held those materials were neither privileged nor work product. It pointed to three things: the chatbot wasn't a lawyer, the platform's privacy policy allowed it to collect, use, and disclose what he submitted, and sending the materials to his lawyers afterward didn't make them privileged. It also held that he waived privilege over information from his lawyers that he put into the chatbot. Other trial courts have since protected some AI-assisted litigation materials as work product on different facts, and no appeals court has resolved the question.
• Where advice ends up. This is the most common way privilege is lost. Agents write things down: commit messages, pull requests, tickets, chat summaries, memory files. Repositories are shared with engineers, contractors, auditors, and acquirers, and kept for years. Legal advice pasted there may be disclosed and treated as waived.
• Mixed content. Privilege protects legal advice, not engineering. A document that is mostly technical requirements may not be privileged at all, whatever its label. Courts differ on how to treat communications with both legal and business purposes. The D.C. Circuit, in an internal-investigation case, held that privilege can apply when obtaining or providing legal advice is one of the communication's significant purposes, even if it also serves business or compliance purposes (In re Kellogg Brown & Root, Inc., 2014). Some other courts ask for a primary legal purpose. Either way, the communication still has to be confidential and between client and counsel, and that decision did not address AI providers.
• Labels alone. Marking something "privileged" shows intent but doesn't create privilege. What matters is what the communication is and how it was kept.

How to set it up

• Run on the right account. Use an API, business, or enterprise account with no training on your data, and the shortest retention setting available. Tell counsel which provider and account type you use.
• Name the people who direct the agent. Your engagement letter should say who can direct agents that communicate with counsel, and that the agent can't agree to anything for you.
• Split advice from instructions. Ask counsel for two kinds of output: a privileged memo with the analysis and risks, for decision-makers, and implementation material (build specs, test checklists, trigger lists) written as plain requirements with no legal reasoning, safe to commit. This firm's deliverables come that way, with a handling field that says which part is which.
• Keep secrets secret. Store the credential your agent uses to reach counsel in a secret store or environment variable, never in the repository.

Checklist for the agent

• Privileged material from counsel is shared only with the principal and the people they choose.
• Only the parts marked safe to commit are written to the repository.
• No commit message, pull request, issue, ticket, or shared chat contains counsel's advice, questions, or reasoning.
• No memory or rules file (AGENTS.md, CLAUDE.md, memory stores) contains counsel's advice. Storing a matter ID is fine.
• The matter token is in a secret store or environment variable, not in any file in the repository.
• The agent runs on a model account whose terms bar training on the company's data.
• When counsel's advice needs to reach the team, a human decides what to share and how.

Common mistakes

• Pasting counsel's email or memo into a ticket "for context."
• An agent summarizing a legal call in the team's main chat channel.
• A pull request description that explains a change by quoting the legal reason for it.
• Forwarding privileged advice to a vendor or investor without thinking about waiver.
• Using a personal consumer AI account for company legal questions.
• Pasting counsel's advice into a consumer AI tool to summarize or analyze it. That can waive privilege over the advice itself.

Sources

• D.C. Circuit: In re Kellogg Brown & Root, Inc., 756 F.3d 754 (June 2014)
• S.D.N.Y.: United States v. Heppner, 820 F. Supp. 3d 292 (February 2026), opinion

When to talk to counsel

Talk to counsel before you share legal advice outside the company (investors, acquirers, partners), if privileged material has already been posted somewhere widely shared, or if you receive a subpoena or discovery request that could reach your agent's logs.