OpenAI Turns Apple's iCloud Policy Into Trade Secrets Defense in Motion to Dismiss
Resumo
OpenAI apresenta moção para arquivar processo de violação de segredos comerciais movido pela Apple, argumentando que o acesso residual aos dados foi causado pela própria política de iCloud da Apple e falha em revogar acesso quando funcionários saíram; o caso entra em fase decisiva com audiência marcada para outubro de 2026 em corte federal.

OpenAI filed a 31-page motion to dismiss Apple's trade secrets lawsuit on Wednesday, making an argument that turns the case's central narrative on its head: the "residual access" Apple is calling theft was created not by OpenAI's engineers but by Apple's own policy of letting employees use personal iCloud accounts for work — and by Apple's subsequent failure to revoke that access properly when those employees left. With a court-ordered deadline of August 17 for OpenAI to formally respond to Apple's separate request for a preliminary injunction, and a full hearing scheduled for October 1 in San Jose federal court, the case is entering its most consequential stretch.
Partnership to Federal Court: A Quick Timeline
The legal fight traces its roots to a two-year collapse. Apple and OpenAI announced their official partnership in June 2024, integrating ChatGPT into Siri across more than a billion active Apple devices. The relationship deteriorated after Apple announced Google Gemini would power Siri in January 2026, effectively demoting OpenAI from its default position. Apple filed suit in July 2026, and this week both companies filed competing legal motions — Apple pressing for a preliminary injunction while OpenAI moved to throw the case out entirely.
Apple's Security Policy Is Now OpenAI's Strongest Legal Argument
OpenAI's motion does two things simultaneously: it attacks Apple's complaint on technical legal grounds, and it introduces a factual counternarrative supported by published exhibits.
On the legal side, OpenAI argues Apple failed to identify trade secrets with enough specificity to survive a motion to dismiss. That argument faces a significant obstacle in this jurisdiction. The Ninth Circuit Court of Appeals — which governs the Northern District of California where this case is filed — ruled in Quintara Biosciences, Inc. v. Ruifeng Biztech, Inc. that federal trade secret law imposes no particularity requirement on plaintiffs at the pleading stage, pushing that requirement back to summary judgment or trial. Apple only needs to plausibly allege misappropriation, a much lower threshold. OpenAI's lawyers know this: the Ninth Circuit case is cited in the same legal community that will argue before the same bench. The specificity argument is unlikely to succeed on its own.
The stronger argument — and the one attracting the most legal attention — is the security-practices defense. OpenAI's motion, supported by newly filed exhibits and a blog post containing the underlying message records, contends that Apple allowed employees to use personal iCloud accounts for work purposes and then failed to properly revoke system access when those employees departed. The motion argues that former engineer Chang Liu's continued ability to access Apple's shared file servers after his January 2026 departure was a foreseeable consequence of Apple's own policy architecture — not evidence of deliberate theft. "Apple cannot transform the foreseeable consequences of its own systems and policies into evidence of theft by former employees who were not aware of their latent access," OpenAI wrote in the filing.
This matters legally because trade-secret protection under both California and federal law requires the owner to have taken adequate reasonable measures to maintain secrecy of the information. A company that routes confidential collaboration through employees' personal iCloud accounts — and then fails to terminate that access on departure — faces a serious argument that its security practices were not "reasonable" within the meaning of the law. If a court accepts that argument even in part, specific categories of Apple's alleged trade secrets could lose legal protection entirely.
The structural iCloud vulnerability OpenAI is pointing to is not hypothetical. Reporting by The Information, citing over six former Apple employees, described how files shared via iCloud Drive links continued to synchronize to personal devices indefinitely after those employees left Apple — bypassing standard enterprise credential revocation procedures because iCloud Drive shared links persist until explicitly revoked by the file owner, not by an organization's IT team. Apple has said its OpenAI lawsuit does not concern iCloud sync files of that type, which draws a legal distinction between the voluntary sync gap and Liu's alleged exploitation of a server authentication vulnerability — but OpenAI's motion conflates the two access vectors into a single "foreseeable consequences of your own policies" narrative, and the distinction will require Apple to untangle them in its response.
What Apple's iCloud Policies Have to Do With Its Own Lawsuit
The iCloud argument is also the article's larger implication — one that extends well beyond this specific case. Any organization that routes confidential work through consumer cloud services faces the same structural exposure OpenAI is now using against Apple. When employees share files via personal iCloud accounts, Google Drive, or similar consumer tools, the organization's standard offboarding checklist — revoking corporate email, deactivating SSO, wiping managed devices — does not automatically terminate that access. The files remain on the former employee's personal device, syncing from a personal account the company never controlled.
Industry data on offboarding security gaps reinforces how common this problem is. According to a 2026 offboarding security survey, 71% of organizations have no formal offboarding process, and 41% fail to collect all devices at departure. A 2023 study found that nearly 47% of workers admitted to using former employers' passwords to access email or software after leaving, with more than half saying the company never changed those passwords. The average time between an employee's departure and access revocation is more than three days when the process is handled manually.
For Apple specifically, the vulnerability carries an additional reputational dimension. The company has pursued trade-secret claims in multiple prior high-profile disputes: in 2022, Apple sued chip startup Rivos, alleging that dozens of former Apple engineers who joined Rivos took gigabytes of SoC design files on USB drives, personal cloud storage, and full device backups. That case settled in early 2024, with Apple gaining forensic inspection of Rivos' systems as a key remedy. In 2019, Apple sued chip chief Gerard Williams after he left to found Nuvia; Apple withdrew that case in April 2023 without explanation.
The Rivos case is the closest structural precedent to the OpenAI suit — and it contains an important warning for Apple. Judge Edward Davila found in August 2023 that Apple had sufficiently identified its trade secrets and alleged sufficient harm for the individual-level claims to proceed, but dismissed corporate-level claims against Rivos for insufficient allegations of how individual misconduct could be imputed to the corporation. OpenAI's motion to dismiss is making exactly that imputation argument: even if Liu or Tang Tan did something inappropriate, Apple has not adequately alleged that OpenAI as an institution directed or ratified that conduct.
What OpenAI Published — and Why It's Unusual
Alongside the motion to dismiss, OpenAI published a detailed public response blog post titled "Apple is getting this wrong," which included the full email chain from the February 2026 pre-litigation outreach period and redacted-but-extensive iMessage records from Liu's departure period.
The email chain revealed something Apple had not disclosed: Apple's outside counsel at Weil, Gotshal & Manges, Gabriel Gross, sent his February 23, 2026 outreach letter to Che Chang, OpenAI's General Counsel, but then sent a second email to the same thread that was actually intended for a different former Apple employee named "Wang" — after confusing the two individuals based on their Asian surnames. Gross later confirmed the mistake in writing, noting he had "inadvertently" sent an email to Chang that was meant for a redacted Wang. Apple's complaint had claimed OpenAI failed to respond to its February outreach; OpenAI's position is that no meaningful outreach reached the right recipient.
Apple's complaint had also asserted that a conversation occurred between its lawyers and OpenAI's General Counsel. Che Chang's response email, published in the OpenAI blog post, contradicts that directly: "This guy from Weil claims to be representing you. For some reason, he is lying about speaking with me on the phone. I don't know who he is and we have never spoken."
The iMessage records OpenAI published offer a different reading of the Liu situation as well. The messages, published with individual names and Apple-specific technical content redacted, show Apple employees reaching out to Liu after his January 22 departure date — asking him to help locate files and technical information to assist them with ongoing Apple work. In one exchange from March 5, 2026, an Apple employee directly asked Liu about circuit architecture details involving Apple product components; Liu offered to connect them with current Apple employees who could answer. OpenAI's motion argues these records show Liu was responding to his former colleagues' requests, not proactively exfiltrating information for OpenAI's benefit.
Apple's complaint reads the same interactions differently: that Liu "guided" a current Apple employee on how to access confidential materials and provided proprietary information. The court will ultimately determine which reading of the messages is more consistent with the full factual record.
Apple Escalates on Two Fronts
Apple is not waiting for the October 1 hearing to apply pressure. Earlier this week, Apple asked the same judge for a motion for preliminary injunction that would bar OpenAI from using any of the allegedly misappropriated secrets while the case moves forward — and separately filed for expedited discovery, seeking depositions of Tang Yew Tan, Chang Liu, a previously named OpenAI employee named Yu-Ting Peng, and corporate representatives from OpenAI and io Products.
Apple also disclosed that its post-filing investigation has identified 11 additional former employees who may have witnessed or participated in the alleged misconduct beyond those already named. Among the new findings: one employee allegedly met with Liu and a named OpenAI staff member before an OpenAI job interview and discussed proprietary information about an unannounced Apple product; another allegedly took screenshots of confidential documents pertaining to an unannounced product before their own interview. Apple also said that after the lawsuit was filed, several former Apple employees now working at OpenAI contacted the company about returning company-issued devices they had retained.
The two sides reached a partial agreement before Apple filed for the injunction. After Apple sent OpenAI a letter offering to forgo the motion if OpenAI agreed to five conditions — stop accessing Apple confidential information, halt any disclosure, preserve all evidence, permit forensic inspection of relevant devices and cloud accounts, and search its own systems for Apple confidential information — OpenAI agreed to the first three but rejected forensic inspection and the self-search requirement. That rejection prompted Apple to seek court intervention.
OpenAI called the injunction request "based on false information and completely unnecessary" in its public blog post response, arguing it does not possess Apple trade secrets and has no desire for them.
What Makes Motion-to-Dismiss Arguments Hard to Win Here
OpenAI's motion also mounts a detailed factual challenge to Apple's characterization of Tan's conduct — arguing that Tan followed industry recruiting norms and that the document Apple describes as a guide to "evading" offboarding procedures was actually used to ensure new hires properly followed Apple's protocols. This recharacterization may or may not persuade a judge at the pleading stage, but it is less likely to succeed than the security-practices argument precisely because courts on a motion to dismiss must accept the plaintiff's well-pleaded facts as true.
The procedural posture works in Apple's favor. Apple's complaint filed specific, discrete allegations: a physical device retained after departure, messages describing network access discovered after departure, and physical components allegedly brought to interviews. Those are checkable factual claims that courts allow plaintiffs to develop in discovery — they are not the kind of generalized grievance courts throw out before any evidence is gathered.
The more interesting question is whether the case survives not the motion to dismiss but the preliminary injunction hearing on October 1. A preliminary injunction requires Apple to show it is likely to succeed on the merits, that it would be irreparably harmed without the injunction, that the balance of harms favors it, and that the public interest favors the injunction. If OpenAI successfully argues at that hearing that Apple's own policies eroded its trade-secret protections, it may be able to defeat the injunction even if the underlying case survives.
Can Apple's Lawsuit Block OpenAI's AI Device?
California courts have explicitly rejected the inevitable disclosure doctrine — the theory that former employees inevitably transfer trade secrets through their general expertise — making it impossible for Apple to seek an injunction simply because former engineers moved to a competitor. Apple's path to injunctive relief runs through what the Rivos court identified as the viable route: tracing specific, identified alleged trade secrets to specific design decisions in OpenAI's hardware program. That is a discovery-intensive argument that takes years to build. Bloomberg Intelligence has assessed that targeted preliminary relief — evidence preservation, compliance certification, and isolation of disputed materials — is more likely than a broad product-development halt.
OpenAI has maintained publicly that it does not have, and has no interest in, Apple's trade secrets, and that its hardware program is developing something entirely distinct from Apple's products.
The practical pressure point is the discovery process if the case survives. Depositions of Tan and Liu would require both individuals to give sworn testimony about what they knew when they left Apple, what they communicated during the recruiting process, and how those communications were used in OpenAI's hardware development. That process — regardless of its ultimate legal outcome — exposes sensitive details about OpenAI's product roadmap, its hardware architecture decisions, and its recruiting methodology at a time when the company is heading toward an initial public offering.
Frequently Asked Questions
What is the strongest part of OpenAI's motion to dismiss?
Not the argument about insufficient specificity — the Ninth Circuit has held that the federal Defend Trade Secrets Act does not require trade-secret identification until summary judgment, which is a procedural protection that favors Apple at this stage of the litigation. The stronger argument is the security-practices defense: OpenAI's contention that Apple's own iCloud policies created the credential-persistence gap that allowed Liu's continued access, undermining Apple's claim that it took "reasonable measures" to protect the information. Under both California and federal trade-secret law, information is not legally protected if the owner failed to take reasonable measures to keep it secret. If Apple encouraged employees to use personal iCloud accounts for confidential collaboration — and then failed to terminate that access after departure — specific categories of alleged trade secrets may not qualify for legal protection at all.
How could Apple's iCloud policies affect whether its information qualifies as a trade secret?
Trade-secret law does not protect information that an employer failed to guard adequately. Both the federal Defend Trade Secrets Act and California's Uniform Trade Secrets Act require that the plaintiff took "reasonable measures to keep such information secret." A company that routes confidential work through employees' personal iCloud accounts — which sync files to personal devices and persist after employment ends because iCloud Drive shared links are not terminated by standard corporate credential revocation — faces a genuine argument that it did not meet this statutory standard. If the court agrees that specific categories of Apple's alleged trade secrets were kept in environments Apple did not adequately control, those categories lose legal protection regardless of what individual employees did with them.
Who determines what constitutes "reasonable measures" to protect a trade secret?
Courts apply a fact-specific, context-sensitive standard. The question is not whether a company had a policy forbidding disclosure, but whether it enforced that policy through actual technical and operational measures. For digital information, courts look at access controls, monitoring, offboarding procedures, and whether the company created conditions — such as mixing personal and work data in consumer cloud accounts — that made the information inherently harder to protect. Apple's use of personal iCloud accounts for work data, combined with its apparent failure to comprehensively terminate access upon departure, is the factual basis on which a court could find its measures were insufficient. No court has yet ruled on this question in this specific case.
What happens if OpenAI's motion to dismiss fails?
The case proceeds to discovery — a phase in which both companies would be required to produce internal documents, submit to depositions, and disclose details about their hiring practices, hardware roadmaps, and data-security posture. For OpenAI, that means sworn testimony from Tang Yew Tan and Chang Liu about what they knew when they left Apple, what was communicated during recruiting sessions, and how those communications informed hardware development decisions. For Apple, it means disclosing the specifics of its iCloud policies, its offboarding procedures, and potentially the details of the unreleased products it claims were compromised. The preliminary injunction hearing on October 1 is the next critical gate; if Apple wins even limited injunctive relief there, OpenAI faces operational constraints on its hardware program while discovery proceeds.
ⓒ 2026 TECHTIMES.com All rights reserved. Do not reproduce without permission.