Apple v. OpenAI: the leak was offboarding, not espionage
Apple's widened trade-secret case against OpenAI turns on kept laptops and pre-interview screenshots. Here's what that costs a small Sri Lankan team, and the free fixes.
The Apple OpenAI trade secrets lawsuit got wider today, and the new details should bother anyone who has ever let a teammate walk out still holding a company laptop. According to TechCrunch, Apple's 4 August 2026 filing says its investigation has turned up 11 more former Apple employees who may have been witnesses or otherwise involved.
Read the alleged conduct closely and there is almost no hacking in it. That is the part worth writing about.
🔍 The alleged leaks are unglamorous, and that matters
Apple sued on 10 July 2026. The new filing asks the court for expedited discovery, and Apple notes its motion for a preliminary injunction is still pending, aimed at stopping OpenAI from building devices on Apple technology. Two named ex-Apple people are Chang Liu, described as a senior systems engineer, and Tang Yew Tan, described as Chief Hardware Officer at OpenAI.
Now look at what Apple actually describes:
| Alleged act | Tooling required | Where the control failed |
|---|---|---|
| Ex-employees kept Apple-issued work devices after leaving, and only offered to return them after the complaint was filed | None | Offboarding / asset return |
| A former employee took screenshots of confidential documents about an unannounced product before an OpenAI interview | Screenshot key | Data-loss monitoring, exit review |
| A former employee met accused employees before an OpenAI interview to discuss proprietary unannounced products | A conversation | Culture, NDA reinforcement |
No zero-day. No exfiltration server. A screenshot key and a coffee.
Key takeaway: the failure mode in the biggest AI trade-secret fight of the year is administrative, not technical. If your security story starts at the firewall, it starts in the wrong place.
OpenAI denies all of it, saying "we do not have, nor want, any of their trade secrets," and has pointed at Apple's own procedural errors and security practices as the reason departed staff retained access at all. That defence is instructive on its own: "you didn't lock it" is a real argument, and it is one your ex-employee's new employer will happily make about you.
🛠️ Your offboarding log is your legal position
Trade-secret protection is not automatic. Broadly, across jurisdictions, you get it because the information has commercial value and because you took reasonable steps to keep it secret. Apple can afford to argue that point for years. A five-person team in Colombo gets one shot, usually in an email thread with a client asking why their unreleased design showed up somewhere else.
So write things down. A dated offboarding record is cheap to produce and hard to argue with later:
- Revoke on the last day, not the last week. Google Workspace, GitHub, AWS, Figma, the shared password vault, the WhatsApp group. One list, one sitting.
- Rotate every shared secret that person could see. Deploy keys, API tokens, database passwords, the client's cPanel login. Shared credentials do not have an owner, so they never get revoked by removing a user.
- Get devices back in writing. A signed line saying "returned MacBook, serial C02X..., 4 August 2026" outperforms any memory of the conversation.
- Re-read the NDA together at exit. Ten minutes. It is far more effective as a reminder than as a threat.
- Keep the log. Date, action, who did it. This is the artifact that shows you took reasonable steps.
If you cannot produce a list of every system a departed engineer had access to, you do not have a security problem yet. You have a bookkeeping problem, which becomes a security problem the day someone leaves badly.
💼 If you are the one interviewing at a foreign company
Plenty of Sri Lankan engineers are interviewing remotely with companies in the US, Singapore, Dubai and the EU right now. This case is a warning aimed squarely at you, because the two most damaging allegations both happened before an interview, not after a job offer.
Things that read as ordinary preparation and land as evidence:
- Screenshotting architecture diagrams, dashboards or roadmaps "so I can talk about my work."
- Emailing yourself code, docs or metrics from a work account to a personal one.
- Walking a friend through your employer's unreleased product to prep for a panel.
- Keeping the work laptop after the last day because nobody chased it.
The safe version costs nothing. Describe problems and outcomes, never artifacts: "I cut p99 latency by rewriting a batching layer" is a strong answer and carries no confidential payload. If you must show something, show your own side projects. If the interviewer pushes for internal specifics, that is a red flag about them, not an invitation.
And handle the paperwork you do share carefully. Screenshots and photos carry metadata; strip it before sending a portfolio file with our EXIF metadata viewer so you know exactly what is embedded.
💰 What a two-person team can actually afford
You do not need an enterprise DLP licence. You need controls that survive a resignation on a Friday.
| Risk | Free or near-free control | Effort |
|---|---|---|
| Shared passwords nobody can revoke | Password manager with per-person accounts; no credentials in WhatsApp | 1 hour setup |
| Credentials sent over chat and left there | Send them as a self-destructing link, like our one-time secret tool | Per use, seconds |
| Ex-staff still in GitHub / cloud | Written offboarding checklist plus a quarterly access audit | 30 min/quarter |
| No proof of what was protected | Dated offboarding log in a shared doc | 5 min per exit |
| Unclear ownership of work | Signed NDA and IP-assignment clause in every contract, including interns | One template |
Two additions worth the effort: give clients and staff the least access that lets them work, and separate personal from company accounts from day one. Mixed accounts are why "return the device" turns into a negotiation.
💡 What this means for you
Apple and OpenAI will spend more on this dispute than most Sri Lankan software companies will earn this decade, and the underlying facts are still: someone kept a laptop, someone took a screenshot, someone talked before an interview.
- If you employ people: your offboarding checklist is a security control, and its written record is your evidence. Build it this week.
- If you are job-hunting: prepare with your own words, never your employer's files. The screenshot you take today is discoverable years later.
- If you are a client or contractor: ask how access is revoked when someone leaves. It is a fair question and the answer tells you a lot.
I am not a lawyer and this is not legal advice. But the operational lesson does not need one. The controls that would have prevented every allegation in this filing are boring, free, and take an afternoon.