Protecting Trade Secrets In The Age Of AI
Artificial intelligence is creating new vulnerabilities for trade secrets as former employees use proprietary company data to train competing AI agents and bypass years of required industry expertise.
By Seth Kugler
If you have only worked in an industry for six months, you usually lack the background needed to steal your employer’s clients and launch a rival venture. However, you might think differently if you plan to use your company’s proprietary data to train an artificial intelligence agent to do the heavy lifting for you.
That is precisely what an individual attempted in a recent federal trade secrets lawsuit I litigated for a client in the U.S. District Court for the Northern District of California. In that dispute, a former senior employee at a marketing agency did not merely copy client rosters to pursue accounts. Instead, the defendant used stolen trade secrets as training inputs to construct an AI-driven version of his former boss, attempting a shortcut to build a competing enterprise without spending years developing the skills and expertise normally required to deliver those services.
Artificial intelligence is giving rise to novel methods of misappropriating trade secrets, moving well past the traditional theft narrative of an employee downloading files onto a flash drive. This case exposes a new reality for startup founders, highlighting unprecedented vulnerabilities concerning AI and trade secrets, employee reliance on personal hardware, and the pressing need for businesses to defend themselves in the era of agentic AI.
Key lessons for founders
AI contamination cannot be undone
The defense argued in this matter that because their client placed the purloined documents into a “quarantine folder” and had not yet poached any clients, no actual harm had occurred.
The court properly recognized that the “quarantine folder” was entirely inadequate, issuing a temporary restraining order and preliminary injunction while classifying the competing AI agent as an “existential threat.”
An agreement promising not to touch the stolen documents themselves becomes largely meaningless once artificial intelligence enters the equation. When a trade secret is used to train a machine learning model or an AI agent equipped with recursive capabilities, it contaminates the model, and the fallout can be extremely difficult to reverse. Even if raw source files are thoroughly scrubbed of any direct evidence pointing to stolen materials, defendants will find it hard to demonstrate to a court that the AI is not functioning a certain way precisely because it previously accessed that proprietary data.
Personal devices can pose big risks
While trade secret theft has historically been deliberate, AI now introduces significant dangers of accidental violations. Startups frequently grow with team members operating on personal hardware under standard Confidential Information and Invention Assignment Agreements. Running desktop AI agents on these personal devices can present substantial exposure.
Unlike standard web interfaces, a desktop AI agent can scan files, generate folders, and ingest directory paths across a local hard drive, often without requesting special permission or notifying the user.
At this moment, thousands of employees may be unintentionally breaching confidentiality terms by running consumer AI tools on personal laptops that also store their employers’ intellectual property. If application settings permit model training using this information, courts may eventually rule that these trade secrets forfeited their legal protections due to distribution outside the organization.
Standard IT audits won’t catch AI data theft
This recent lawsuit serves as a warning regarding how attorneys and founders must approach trade secret investigations. Conventional digital discovery is no longer adequate because AI applications make it simple to scatter, modify, and regenerate data across non-obvious directory paths.
Measures that once seemed excessive—such as complete forensic imaging of a personal device—now represent the bare minimum. Furthermore, artificial intelligence significantly lowers the barriers to reverse-engineering software and technical products, potentially erasing clear indicators that code or data was copied.
Establishing theft in an AI context demands intensive, highly technical expert analysis and carries far more uncertainty than standard intellectual property litigation.
3 practical steps companies should take
Founders should take three legal and operational steps to proactively protect their business:
- Implement strict agentic AI policies: Mandate tight controls and settings that isolate outside AI from company documents. Web-based tools like Claude with strict data privacy policies are vastly safer than open source or desktop apps that crawl local drives. Some AI agents should not be permitted to run at all within an environment containing trade secrets.
- Eliminate remote access from unmanaged devices: Shift to a closed cloud environment where data can be viewed and manipulated on a secure server, but files cannot be downloaded locally to a personal desktop. Removing local file downloads eliminates the risk of desktop AI agents indexing proprietary data.
- Rewrite your Confidential Information and Invention Assignment Agreements for the AI era: Standard confidentiality agreements need explicit clauses addressing AI use, model training inputs, and a precise definition of data misappropriation through machine learning.
If you suspect an employee has walked away with data or misused it in an AI tool, your first step should be immediate: cut off all system access and retain counsel. Don’t wait until you start losing clients or experiencing financial losses. Feeding trade secrets into AI presents an existential threat from day one.
AI gives individuals the unprecedented ability to compete in spaces where they lack experience, making proprietary data more vulnerable than ever. Modernizing security, policy and legal strategies to address today’s AI threats will help startups and established companies avoid catastrophic exposure.
Frequently Asked Questions
01Can an AI model be “cleaned” if it was trained on stolen trade secrets?
Generally, no. Once a trade secret is used to train a machine learning model, the contamination is extremely difficult to undo, and defendants often struggle to prove the AI’s behavior is independent of the proprietary data it once accessed.
02Why are personal devices a major risk for trade secret protection?
Desktop AI agents can autonomously scan files, create folders, and ingest directories across local hard drives without user notification, potentially exposing company intellectual property to external model training and destroying legal protections.
03What is the first thing a company should do if data theft via AI is suspected?
Immediately cut off all system access for the individual in question and retain legal counsel before financial losses or client defections occur.
Seth Kugler is a partner at Grellas Shah LLP, where he focuses on complex commercial litigation, including disputes related to trade secret and IP misappropriation, corporate governance and breach of fiduciary duties, breach of contract, and other complex business disputes. He specializes in preventing and resolving all manner of disputes among and between corporate founders, directors, officers and shareholders, LLC members, and other current and former business partners.
Illustration: Dom Guzman
