Safeguarding Trade Secrets In The AI Era

By Seth Kugler

If you only possess half a year of industry experience, you are typically not prepared to steal your employer’s clients and launch a rival venture. Naturally, you might think otherwise if your plan involves leveraging your employer’s proprietary data to train an artificial intelligence agent to handle the difficult work for you.

That precise scenario occurred when a defendant attempted this exact maneuver in a recent federal trade secrets lawsuit I handled for a client within the U.S. District Court for the Northern District of California. In that litigation, a former senior team member at a marketing agency did not merely duplicate client rosters to pursue accounts. Instead, the individual utilized pilfered trade secrets as training inputs to essentially construct an AI replica of his former supervisor, seeking a shortcut to establish a competing enterprise without investing the years required to acquire the skills and expertise normally necessary to deliver those services.

Artificial intelligence is giving rise to novel methods of misappropriating trade secrets, moving well past the traditional theft narrative of an employee copying documents onto a USB drive. This lawsuit underscores a new reality for startup founders, bringing to light unprecedented hazards associated with AI and trade secrets, the utilization of personal devices by staff, and the heightened necessity for businesses to safeguard themselves during the era of agentic AI.

Key lessons for founders

AI contamination cannot be undone

The defense in this specific matter argued that because their client placed the stolen files into a “quarantine folder” and had not yet secured any poached clients, no damage had occurred.

The presiding court correctly determined that the “quarantine folder” was entirely inadequate, issuing a temporary restraining order and preliminary injunction while acknowledging the rival AI agent as an “existential threat.”

An agreement promising simply not to touch the stolen documents loses its relevance once artificial intelligence becomes involved: When a trade secret is employed to build a machine learning framework or to train an AI agent endowed with recursive functions, the model becomes contaminated, and the consequences can prove nearly impossible to reverse. Even if original source files are completely scrubbed of any direct traces of the stolen content, defendants will find it exceedingly difficult to convince courts that the AI is not behaving a certain way specifically because it previously had access to that proprietary information.

Personal devices can pose big risks

While trade secret theft has historically been deliberate, artificial intelligence now introduces substantial dangers concerning unintentional breaches. Startups frequently grow with team members operating on personal hardware under standard Confidential Information and Invention Assignment Agreements. Running desktop AI agents on these computers can present a severe vulnerability.

Unlike standard web-based portals, a desktop AI agent has the ability to examine documents, generate directories, and ingest folder paths across a local hard drive, frequently without demanding special authorization or notifying the user.

At this moment, thousands of employees may be inadvertently breaching confidentiality rules by utilizing consumer AI applications on personal laptops that store their employers’ intellectual property. If configuration settings permit model training utilizing this information, courts may ultimately determine that these trade secrets forfeited their legal protections due to distribution outside the organization.

Standard IT audits won’t catch AI data theft

This recent legal battle acts as a warning regarding how attorneys and founders must approach trade secret investigations. Conventional digital discovery no longer suffices because AI technologies make the distribution, modification, and recreation of data across non-obvious folder structures effortless.

Measures that previously felt excessive—such as complete forensic imaging of a personal gadget—are now considered the bare minimum. Furthermore, artificial intelligence substantially lowers the barrier to reverse-engineering software and technical goods, potentially eliminating obvious indicators that code or information was duplicated.

Demonstrating theft within AI environments demands intensive, highly specialized expert evaluations and involves significantly greater uncertainty than standard intellectual property litigation.

3 practical steps companies should take

Founders ought to execute three operational and legal measures to actively protect their enterprises:

1. Implement strict agentic AI policies: Enforce rigorous controls and configurations that isolate external AI from corporate documentation. Web-oriented solutions such as Claude, which feature strict data privacy guidelines, are considerably more secure than open-source or desktop applications that scan local storage drives. Certain AI agents should not be allowed to operate at all inside an environment housing trade secrets.
2. Eliminate remote access from unmanaged devices: Transition toward a restricted cloud infrastructure where data can be viewed and manipulated on a secure server, preventing local file downloads to personal desktops. Removing local file downloads removes the hazard of desktop AI agents indexing proprietary information.
3. Rewrite your Confidential Information and Invention Assignment Agreements for the AI era: Traditional confidentiality pacts require clear clauses covering AI utilization, model training inputs, and a precise description of data misappropriation via machine learning.

Should you suspect that a staff member has departed with data or misused it within an AI tool, your immediate priority must be absolute: revoke all system access and secure legal counsel. Do not wait until clients begin leaving or financial losses mount. Feeding trade secrets into artificial intelligence poses an existential danger right from day one.

Artificial intelligence grants individuals the unprecedented capacity to compete in sectors where they lack experience, leaving proprietary data more exposed than ever. Modernizing security, policy, and legal frameworks to tackle contemporary AI threats will assist both startups and mature corporations in evading catastrophic exposure.

---

?Frequently Asked Questions

01What makes AI-driven trade secret theft different from traditional data theft?

Traditional trade secret theft usually involves copying files onto a thumb drive or forwarding documents. AI-driven theft involves feeding stolen information into machine learning models or agentic AI to build competing products or mimic expert knowledge, creating contamination that is extremely difficult to prove and undo.

02Why is a “quarantine folder” insufficient when dealing with AI data contamination?

Once proprietary data is used to train an AI model or recursive agent, the model absorbs those inputs. Even if the original source files are deleted or moved to a quarantine folder, the AI’s behavior may still be permanently influenced by the stolen information.

03How can startups protect their intellectual property from desktop AI agents?

Founders can protect their data by implementing strict agentic AI policies, eliminating local file downloads through unmanaged personal devices, utilizing secure cloud environments, and updating Confidential Information and Invention Assignment Agreements to explicitly cover AI use and machine learning training inputs.

---

---

Seth Kugler is a partner at Grellas Shah LLP, where he focuses on complex commercial litigation, including disputes related to trade secret and IP misappropriation, corporate governance and breach of fiduciary duties, breach of contract, and other complex business disputes. He specializes in preventing and resolving all manner of disputes among and between corporate founders, directors, officers and shareholders, LLC members, and other current and former business partners.

Illustration: Dom Guzman