Business Secrets and AI: Court Warns of Risks

A federal court in California has deemed "quarantine" measures insufficient after the use of stolen information to train an AI agent, labeling it an existential threat. Beyond this case, operational and contractual recommendations are emerging to limit abuses facilitated by local agents and personal device usage.

Existential Threat and Recommended Immediate Response

The use of trade secrets to fuel an AI poses an existential threat from the outset. In a recent case, the Northern District Court of California classified a competing AI agent as an existential threat. In the event of suspected data misappropriation or use in an AI tool, it is recommended to immediately cut off all access to the system and consult a lawyer, without waiting for potential customer or financial losses. This context unfolds during a time when AI enables individuals to compete in areas where they have no prior experience, making proprietary data particularly vulnerable.

Investigating in the Age of Agents: Forensics as a Minimum Threshold

Traditional digital discovery methods are no longer sufficient in the face of AI tools capable of dispersing and modifying data in hard-to-detect locations. Measures once deemed excessive, such as complete forensic imaging of personal devices, are now considered the bare minimum for investigating suspicions of trade secret theft. AI also reduces the difficulty of reverse engineering, complicating the detection of signs of code or data theft. In this logic, a court has determined that a simple quarantine folder does not constitute an adequate response.

Personal Devices and Local Agents: Frontline Vulnerabilities

Many startups operate with employees using their own devices, increasing risks to the protection of trade secrets. An AI agent installed on a workstation can analyze files and access local directory paths, often without specific authorization. Beyond intentional misappropriations, these technical capabilities expose employees to unintentional violations: thousands of employees could inadvertently breach confidentiality agreements by using AI agents on personal computers containing their employer's intellectual property.

The California Case: From "Quarantine" Argument to Rejection

In a case brought before the federal court in the Northern District of California, the defendant, a former executive of a marketing agency, attempted to create an AI version of his former superior using confidential information obtained without authorization. The defense argued that placing the documents in a "quarantine folder" and the absence of client poaching excluded any harm. The court did not accept this argument and considered the AI agent in question to be an existential threat.

AI Governance: Policies, Architecture, and Contracts to Reassess

Several measures are proposed to limit exposure to AI-related risks. First, strict policies governing the use of AI agents should be established, isolating external AIs from internal documents, and prioritizing web tools with rigorous privacy policies over open-source or desktop applications. Next, it is recommended to eliminate remote access from unmanaged devices in favor of a closed cloud environment where files cannot be downloaded locally. Finally, confidentiality and invention assignment agreements should be rewritten to explicitly incorporate the use of AI, training data, and a precise definition of misappropriation through machine learning. These precautions are all the more necessary as once trade secrets are used to train a model, it becomes difficult to reverse this contamination and prove that the AI does not rely on this information. All these measures aim to adapt security, policies, and contracts to the current threats posed by AI to avoid major exposures.