Policy & Regulation
Apple sues OpenAI over alleged trade secret theft
Apple is suing OpenAI, alleging a former engineer exploited a rare authentication bug to steal confidential hardware files after joining the AI startup.
On Friday, Apple filed a lawsuit against OpenAI in a federal court in California, the U.S. District Court for the Northern District of California in San Jose. The complaint accuses OpenAI of the alleged theft of trade secrets, claiming that OpenAI stole Apple’s confidential data and engaged in efforts to learn proprietary information while recruiting former Apple employees.
In the complaint, Apple says the former employee, Chang Liu, a system electrical engineer, allegedly siphoned reams of sensitive files from the company’s shared network folders, weeks after leaving Apple for a job at OpenAI. Apple’s complaint states he allegedly “exploited a rare, previously unknown authentication bug” that allowed access to the company’s network. The bug could have allowed a few other people to access data on Apple’s network, but Apple alleges only Liu did so, taking dozens of Apple’s confidential hardware-related files over several weeks while working at OpenAI. Apple says Liu tried to access its network storage — a cloud-based file repository containing confidential engineering files, project documentation, and other proprietary information — during February 2026.
Apple also claims Liu allegedly failed to return his Apple-issued work laptop and allegedly misused the access of Yu-Ting Peng, another former Apple employee who later joined OpenAI. According to the complaint, Liu allegedly used Peng’s Apple-issued laptop while she was still employed at Apple and he was not, and he joked about his unauthorized access in messages to her, writing that he had discovered he could still get into the company’s network storage.
OpenAI has said it has “no interest in other companies’ trade secrets.” Apple’s lawsuit seeks a jury trial in California.
Why it matters
The disclosure highlights the critical challenges organizations face in protecting sensitive corporate data and fully decommissioning employee access once they depart for competitors.