Key Lessons for Founders

AI Contamination Cannot Be Undone

The defense in the case argued that placing stolen documents in a 'quarantine folder' was sufficient to prevent harm. However, the court recognized that AI tools can make it difficult to undo contamination. If a trade secret is used to develop a machine learning model or used to train an AI agent with recursive capabilities, it contaminates the model and the impact can be difficult to undo. Even if raw source files are completely scrubbed of any direct evidence of stolen materials, defendants will struggle to prove to courts that the AI isn’t operating a certain way precisely because it once had access to that proprietary information.

Personal Devices Can Pose Big Risks

Trade secret misappropriation has typically been malicious, but AI now also creates significant risks of inadvertent violations. Startups frequently scale with employees working on personal devices under standard Confidential Information and Invention Assignment Agreements. Running desktop AI agents on these devices can pose a serious risk. Unlike standard web interfaces, a desktop AI agent can scan files, create folders and ingest directory paths across a local hard drive, often without requiring special permission or alerting the user. Right now, thousands of employees may be inadvertently violating confidentiality agreements by running consumer AI agents on personal laptops that house their employers’ IP. If settings allow model training from this data, courts may eventually find these trade secrets to have lost legal protection due to dissemination outside the company.

Standard IT Audits Won’t Catch AI Data Theft

Traditional digital discovery is no longer sufficient because AI tools make it effortless to disperse, alter and recreate data across non-obvious folder paths. Actions that previously seemed like overkill, such as full forensic imaging of a personal device, are now the bare minimum. Furthermore, AI dramatically reduces the friction of reverse-engineering software and tech products, potentially removing telltale signs that code or data was copied. Proving theft in AI contexts requires intensive, highly technical expert analysis and carries far more uncertainty than traditional IP litigation.

Practical Steps Companies Should Take

Implement Strict Agentic AI Policies

Founders should implement strict agentic AI policies, mandating tight controls and settings that isolate outside AI from company documents. Web-based tools like Claude with strict data privacy policies are vastly safer than open source or desktop apps that crawl local drives. Some AI agents should not be permitted to run at all within an environment containing trade secrets.

Eliminate Remote Access from Unmanaged Devices

Shift to a closed cloud environment where data can be viewed and manipulated on a secure server, but files cannot be downloaded locally to a personal desktop. Removing local file downloads eliminates the risk of desktop AI agents indexing proprietary data.

Rewrite Your Confidential Information and Invention Assignment Agreements

Standard confidentiality agreements need explicit clauses addressing AI use, model training inputs, and a precise definition of data misappropriation through machine learning. If you suspect an employee has walked away with data or misused it in an AI tool, your first step should be immediate: cut off all system access and retain counsel. Don’t wait until you start losing clients or experiencing financial losses.