The Signal #061 — Dakota’s read on the AI news that actually matters to people running a business.

Most operators think about data security at the network level. Firewalls, passwords, access controls. The assumption is that the threat comes from outside.

The Apple versus OpenAI case is a useful reminder that the more common breach is quieter than that.

What happened

Apple is escalating its trade secrets lawsuit against OpenAI, and the scope is getting wider with each new filing. According to reporting from TechCrunch, Apple is now seeking a preliminary injunction to stop OpenAI from developing any AI device or product built on Apple’s technology. The company is also requesting expedited discovery from the accused employees, from OpenAI and its foundation, and from io, the device startup co-founded by Apple’s former lead designer Jony Ive.

The original complaint named senior systems engineer Chang Liu and Chief Hardware Officer Tang Yew Tan. Now Apple says its ongoing investigation has identified 11 other former employees who may have been witnesses or otherwise involved. One former employee allegedly met with Liu and another named employee before an interview at OpenAI and discussed Apple proprietary information about unannounced products during that meeting. Another took screenshots of confidential Apple documents relating to an unannounced product before interviewing at OpenAI. Apple also claims that after it filed its original complaint, multiple former employees who had moved to OpenAI reached out to discuss returning Apple-issued work devices they had kept when they left.

OpenAI pushed back publicly, saying in a blog post that Apple’s request for a preliminary injunction is “both based on false information and completely unnecessary because we do not have, nor want, any of their trade secrets.” OpenAI also noted that Apple had contacted the wrong person at one point, confusing two employees with similar surnames, and alleged that Apple was not forthcoming about conversations with its own general counsel.

The court has not ruled yet. Both sides are still in motion.

Why it matters for operators

This case involves two of the largest companies in the world, but the operational problem at the center of it is not unique to Apple. It shows up in real estate brokerages when an agent leaves for a competitor and takes a client list. It shows up in SaaS companies when an engineer exports a code repository on their last day. It shows up in marketing agencies when an account manager walks out knowing the entire media strategy for a client who has not launched yet.

The specific behaviors described in Apple’s filing are worth reading carefully, because they are not dramatic. Screenshots before a job interview. A work device not returned after offboarding. A meeting between colleagues where proprietary topics came up. None of that requires a sophisticated attack. It requires access that already existed, and an offboarding process that did not close it in time.

Apple itself acknowledged, according to OpenAI’s response, that “residual access” allowing former employees into Apple’s systems may have been the result of its own security procedures. That detail matters. The gap was not necessarily malicious intent at the system level. It was a process that left doors open after people had already left.

For any operator running a team that touches sensitive data, which is most operators at this point, the exposure is not theoretical. It is procedural.

What most people get wrong

The instinct after reading a case like this is to focus on intent. Did the employees mean to steal? Did OpenAI know? Was this orchestrated?

Those are legal questions, and the court will sort them out. The operational question is different, and it is more useful: does your offboarding process actually close access when someone leaves?

Most teams would say yes. The IT checklist has a line for it. But the Apple filing describes employees retaining company devices, retaining what sounds like system access, and having meetings where confidential information changed hands, all after their employment ended. The checkbox got checked somewhere. The access did not close.

The gap between the policy and the practice is where this kind of exposure lives. It is not a villains-and-victims story. It is a process story.

One more thing worth noting. The filing describes a situation where 11 additional people emerged during investigation, not at the time of departure. That is a discovery problem. If you do not have clear records of who had access to what and when, the investigation that would surface your own version of this picture becomes very expensive, very fast.

The short version

AI is accelerating talent movement across the industry. People are leaving big companies to join startups, moving between competitors, and sometimes taking institutional knowledge with them, some of it deliberately, some of it accidentally, some of it because nobody asked for the device back.

The Apple case will run its course in court. The more useful thing for an operator is to ask a simpler question this week: if someone left your team yesterday, what did they still have access to today?

If the answer is not immediate, that is the gap worth closing.

If you are thinking through how AI fits into your operations without creating new exposure, xovionlabs.com is a good place to start.