Trade Secrets and Generative AI: Reasonable Measures, Prompt Leakage, and Vendor Terms

Summary. This article explains how generative AI tools change the three questions every trade secret case turns on: whether information is still secret, whether its owner took reasonable measures to keep it that way, and whether someone acquired it by improper means. It traces the doctrine from Kewanee Oil and Ruckelshaus v. Monsanto through the Defend Trade Secrets Act and the reasonable-measures cases, including Rockwell Graphic Systems, Learning Curve Toys, and Yellowfin Yachts, and applies it to employees pasting confidential material into chatbots. It reads AI vendor terms closely, comparing consumer, business, API, and zero-retention tiers on training use, retention, human review, and subprocessors. It maps the newer leakage paths, including prompt leakage, retrieval systems that ignore permissions, agentic connectors, and prompt injection, and the use of AI to extract or reverse engineer a competitor's information. It also covers prompts, system prompts, outputs, and model weights as trade secrets, the labor-law and privilege overlays, an extended worked example, common mistakes, and an FAQ.

At 4:40 on a Thursday afternoon, a firmware engineer at Corvane Robotics, a 140-person maker of warehouse picking arms, is stuck. The motion-planning module that lets Corvane's arm grab a crushed cardboard box without tearing it has a timing bug, and the release is due Monday. He opens a free chatbot in his browser, pastes in 900 lines of the module, and types: "Find the race condition." The answer is good. He fixes the bug, ships on time, and forgets about it.

Eighteen months later Corvane sues a former senior engineer who left for a competitor with, Corvane says, the grasp-planning algorithm in his head and a folder of design notes on a personal drive. The complaint describes the algorithm as Corvane's most valuable trade secret. At the engineer's deposition, his lawyer spends ten minutes on Corvane's history with AI tools. Then, at Corvane's Rule 30(b)(6) deposition, she asks the company's witness a simple question: "Before this lawsuit, did Corvane have any rule against employees putting source code into public AI chatbots?" The honest answer is no. Her next question is whether Corvane knows how many times its code was submitted to such services, under what terms, and whether those services kept it. Corvane does not know.

Nothing in that exchange proves that the algorithm stopped being secret. But it hands the defense its best argument on the one element that owners most often lose: reasonable measures. This article explains why, what the law actually requires, what AI vendor terms do and do not promise, where the newer leaks come from, and how both owners and accused parties should handle AI in a trade secret dispute.

The short answer

Using an AI tool is a disclosure to a third party. Whether that disclosure destroys secrecy or defeats reasonable measures depends on the tool's terms (training, retention, human review, onward sharing) and on whether the owner authorized, controlled, and recorded the use. Disclosure under a duty of confidentiality is ordinarily safe; disclosure to a recipient free to use the material is not. See Ruckelshaus v. Monsanto Co., 467 U.S. 986 (1984).
Reasonable measures, not perfect ones. Courts ask whether the precautions were reasonable for the value of the secret and the risk, and they look hard at gaps between written policy and actual practice. An undisciplined AI practice is the kind of gap that loses cases. See 18 U.S.C. § 1839(3) and Rockwell Graphic Systems v. DEV Industries, 925 F.2d 174 (7th Cir. 1991).
Tier matters more than brand. Consumer AI products commonly allow training on user content unless the user opts out and may keep conversations for long periods; business and API tiers commonly commit not to train on customer content by default and limit retention; zero-data-retention arrangements go further. Read the terms that actually govern the account in use.
The leak is often not the model. Prompt logs, shared conversation links, retrieval systems that ignore document permissions, browser extensions, meeting bots, and agentic tools with access to email and drives are more common exposure paths than a model reciting training data.
AI cuts both ways on improper means. Reverse engineering and independent derivation remain lawful under 18 U.S.C. § 1839(6)(B), and using AI to analyze a lawfully purchased product is reverse engineering. Using AI to scrape at scale, to defeat technical barriers, or to trick a competitor's chatbot into revealing its instructions can be improper means.
AI work product can itself be a trade secret. System prompts, evaluation sets, fine-tuning data, model weights, and valuable outputs qualify if they meet the statutory definition, which matters more because copyright may not protect machine-generated material.
The policy must survive labor law and the whistleblower statute. Confidentiality rules that sweep in wages and working conditions invite NLRA challenges, and agreements that omit the immunity notice of 18 U.S.C. § 1833(b) forfeit exemplary damages and fees against employees.

For the step-by-step build of a compliant policy, see Building a Generative AI Use Policy That Protects Trade Secrets: A Practical Guide. The controls are itemized in the Generative AI Trade Secret Protection Checklist: A Practical Checklist, and the forms are in the AI Confidentiality Toolkit: Acceptable Use Policies, Vendor Term Reviews, and Incident Playbooks.

Why generative AI is a trade secret problem at all

Patents and copyrights exist because the government grants them. A trade secret exists only as long as its owner keeps it. That single fact explains why AI tools matter so much more to trade secret law than to other IP regimes. A copyright does not vanish because an employee pastes a manuscript into a chatbot. A trade secret can, if the paste is a disclosure the law treats as voluntary and unprotected, or if the paste is one example of a company that never really tried to keep the information confidential.

Every trade secret claim, federal or state, rests on three questions:

Is the information a trade secret? It must derive independent economic value from not being generally known or readily ascertainable, and the owner must have taken reasonable measures to keep it secret.
Was it misappropriated? The defendant must have acquired it by improper means, or used or disclosed it in breach of a duty or with knowledge that it came from someone who breached one.
What relief follows? Injunctions, damages measured by loss, unjust enrichment, or a reasonable royalty, and in egregious cases exemplary damages and fees.

Generative AI touches all three. It creates a new, high-frequency channel for disclosure (question 1). It creates new ways to acquire someone else's information, some proper and some not (question 2). And it creates new categories of valuable information, such as prompts, weights, and evaluation data, whose status as trade secrets is now being litigated (question 1 again, from the other direction).

The doctrine in brief

From the Restatement to the DTSA

American trade secret law began as common law, was organized by the Restatement of Torts in 1939 (section 757 and its six-factor comment), and was largely codified in the Uniform Trade Secrets Act of 1979, amended in 1985. Forty-eight states have adopted a version of the UTSA; New York still relies on the common law, and North Carolina has its own statute. California's version, for example, defines trade secret and misappropriation in Cal. Civ. Code § 3426.1. The Restatement (Third) of Unfair Competition sections 39 to 45 (1995) restated the field, and courts still cite its definition of a trade secret (section 39), its treatment of improper means (section 43), and its approach to monetary relief (section 45).

The Supreme Court confirmed that states may protect trade secrets alongside federal patent law in Kewanee Oil Co. v. Bicron Corp., 416 U.S. 470 (1974). The Court's reasoning matters here. Trade secret protection, it explained, is weaker than a patent because it protects only against improper acquisition and breach of confidence: anyone may discover the secret by fair and honest means, "such as by independent invention, accidental disclosure, or by so-called reverse engineering." Fifteen years later, Bonito Boats, Inc. v. Thunder Craft Boats, Inc., 489 U.S. 141 (1989), repeated that reverse engineering of products in public commerce is a legitimate route to knowledge that states cannot forbid by recharacterizing it.

Congress added a federal civil claim with the Defend Trade Secrets Act of 2016, which amended the Economic Espionage Act. The private right of action is in 18 U.S.C. § 1836; the definitions are in 18 U.S.C. § 1839; the criminal provisions remain in 18 U.S.C. § 1832 (theft of trade secrets) and 18 U.S.C. § 1831 (economic espionage for a foreign government). The DTSA does not preempt state law, so most complaints plead both. For the litigation mechanics, see Trade Secret Misappropriation Litigation Under the Defend Trade Secrets Act: A Practical Guide.

The statutory definition, read for AI

Under § 1839(3), "trade secret" covers "all forms and types" of financial, business, scientific, technical, economic, or engineering information, "whether tangible or intangible, and whether or how stored," if two conditions are met:

(A) Reasonable measures. "The owner thereof has taken reasonable measures to keep such information secret."
(B) Independent economic value. The information "derives independent economic value, actual or potential, from not being generally known to, and not being readily ascertainable through proper means by, another person who can obtain economic value from the disclosure or use of the information."

Three features of that text matter in AI disputes. First, "whether or how stored" means a secret encoded in model weights, a vector database, or a prompt template is as eligible as one in a lab notebook. Second, "readily ascertainable through proper means" invites the argument that if a generic AI model can produce the information on request, it is not a secret. That argument is usually weaker than it sounds (whether information is readily ascertainable from a public source depends on what the source actually reveals, as the Fifth Circuit held for a published patent application in Tewari De-Ox Systems, Inc. v. Mountain States/Rosen, L.L.C., 637 F.3d 604 (5th Cir. 2011)), because a model that can generate many plausible answers does not tell the user which one is right, and the value of a trade secret often lies in knowing which approach works. Third, the reasonable-measures prong is phrased as a condition of the owner's conduct, which is why defendants spend so much time on what the owner allowed its employees to do.

Misappropriation, defined in § 1839(5), has two branches: acquisition by someone who knows or has reason to know it was acquired by improper means, and disclosure or use without consent by someone who used improper means, or who knew the information came through a person who owed a duty of secrecy, or who learned it by accident or mistake before a material change of position. "Improper means," in § 1839(6), "includes theft, bribery, misrepresentation, breach or inducement of a breach of a duty to maintain secrecy, or espionage through electronic or other means," and "does not include reverse engineering, independent derivation, or any other lawful means of acquisition."

Remedies, briefly

A court may enjoin actual or threatened misappropriation, but under § 1836(b)(3)(A) it may not prevent a person from entering an employment relationship, and conditions on employment must rest on evidence of threatened misappropriation rather than on what the person merely knows. Damages may be measured by actual loss plus unjust enrichment not counted in the loss, or by a reasonable royalty. Willful and malicious misappropriation supports exemplary damages of up to twice the award and attorney's fees. The limitations period is three years from discovery under § 1836(d). Remedies are covered in depth in Trade Secret Damages and Remedies: Unjust Enrichment, Reasonable Royalties, Injunctions, and Exemplary Awards.

Secrecy: what happens to information you put into a model

Disclosure is not the same as loss

The law has never required absolute secrecy. Companies share secrets with employees, contractors, suppliers, licensees, auditors, and cloud providers every day. The question is whether the sharing was limited and protected. Two lines of authority frame the inquiry.

The first is the loss line. In Ruckelshaus v. Monsanto Co., 467 U.S. 986 (1984), the Court held that pesticide health and safety data were property protected by the Takings Clause, and then explained what defines that property: because a trade secret is intangible, the extent of the right is defined by the extent to which the owner protects it from disclosure to others, and once the owner discloses the data to others who are under no obligation to protect them, or allows others to use them, the owner loses the property interest. Monsanto lost protection for data submitted after Congress put submitters on notice that the agency could use and disclose them, because Monsanto submitted with knowledge of those terms. The analogy to an AI service is direct. A user who submits information under terms that grant the provider rights to use it for training, to have humans review it, and to retain it indefinitely is, in the Court's framing, submitting with notice.

The second is the limited-disclosure line. In Metallurgical Industries Inc. v. Fourtek, Inc., 790 F.2d 1195 (5th Cir. 1986), the court held that disclosing a process to two other companies, in connection with business dealings and with an expectation of confidentiality, did not destroy secrecy. Limited disclosure for the owner's economic benefit is consistent with keeping a secret. An enterprise AI service that processes data only to provide the service, under a confidentiality clause, sits comfortably in this line.

The Supreme Court's reading of "confidential" in a different statute is a useful cross-check. In Food Marketing Institute v. Argus Leader Media, 588 U.S. 427 (2019), the Court held that commercial information is "confidential" under FOIA Exemption 4 at least where it is customarily and actually treated as private by its owner and provided to the government under an assurance of privacy. The case does not decide trade secret questions, but the two ideas it identifies, actual private treatment and an assurance of privacy from the recipient, are what a court will look for when an AI provider is the recipient.

Public posting and the internet cases

Courts have also confronted secrets that escaped onto the internet. In Religious Technology Center v. Netcom On-Line Communication Services, Inc., 923 F. Supp. 1231 (N.D. Cal. 1995), the court recognized that posting on the internet can destroy trade secret status, even when someone else does the posting wrongfully, and that a person who merely finds the information online has not misappropriated it. Later decisions turn on how widely the material spread and how quickly the owner acted. In DVD Copy Control Ass'n v. Bunner, 116 Cal. App. 4th 241 (2004), a California appellate court reversed a preliminary injunction against a website operator because the record did not show that a decryption program was still secret when he posted it; by then it had spread rapidly across the internet. The AI analog is a shared conversation link that gets indexed, or a public "custom assistant" whose uploaded knowledge files can be coaxed out. Both are internet publication problems, and the speed of the owner's response matters.

What AI providers actually do with inputs

The legal analysis depends on facts about the service. Five practices determine the risk:

Practice	What it means	Why it matters for secrecy
Training use	Inputs and outputs may be used to train or improve future models	Information can become part of a model available to others; it also signals that the provider is free to use the content
Retention	How long prompts, files, and outputs are stored, and whether deletion by the user deletes the provider's copy	Longer retention means a larger breach surface and a longer discovery and legal-hold window
Human review	Provider staff or contractors may read conversations for safety, abuse, or quality	A human recipient outside the owner's control is a disclosure in the plainest sense
Onward sharing	Subprocessors, affiliates, and plug-in or connector providers that receive data	The confidentiality chain must extend to every recipient
Confidentiality commitment	Whether the terms treat customer content as confidential information, with security obligations	This is the assurance of privacy that distinguishes protected limited disclosure from release

Training use gets the most attention, but it is not the only issue and it is often not the largest. A model trained on a corpus that includes one company's code is unlikely to reproduce that code verbatim on request, though it is not impossible. Researchers have shown that large language models memorize and can be induced to emit portions of their training data: work by Carlini and colleagues extracted memorized sequences from GPT-2 in 2021, and a 2023 study by Nasr and colleagues reported extracting training data from a production chatbot with a simple repeated-word prompt. Memorization is more likely for text that appears many times or is unusual, and fine-tuned models trained on a small, specific dataset are more prone to it than general models. The practical lesson is not that every prompt becomes public. It is that an owner who lets secrets flow into training data cannot promise a court that they stayed confined.

The Samsung episode

The incident that put this issue in front of general counsel everywhere happened in early 2023. According to press reports, engineers in Samsung's semiconductor business entered confidential material into a consumer chatbot in at least three separate incidents within weeks of being allowed to use it: source code for a measurement database, code related to defect detection, and a recording of an internal meeting submitted for conversion into minutes. Samsung responded by restricting generative AI tools on company devices and networks while it built internal alternatives. No lawsuit followed, and there is no reported finding that anything was lost. The episode is cited because it showed how fast ordinary, well-meaning use creates exposure, and because the response (a ban first, an approved internal tool later) became the template many companies followed.

Reasonable measures in the age of chatbots

What the cases require

Reasonable measures is a fact question, and courts resolve it by looking at the whole program. Four cases supply most of the vocabulary.

E.I. duPont de Nemours & Co. v. Christopher, 431 F.2d 1012 (5th Cir. 1970), involved photographers hired to fly over a methanol plant under construction and photograph the process layout. The Fifth Circuit held that the aerial photography was improper means even though no law was broken in the air, and it rejected the idea that DuPont had to build a roof over the construction site. Requiring that, the court said, would impose an enormous expense to prevent "a school boy's trick." The point that carries into AI: the law does not require a company to anticipate and defeat every technique. It requires precautions proportionate to foreseeable risks.

Rockwell Graphic Systems, Inc. v. DEV Industries, Inc., 925 F.2d 174 (7th Cir. 1991), is the vendor case. Rockwell sent thousands of piece-part drawings for printing-press parts to outside vendors so they could bid and manufacture, stamped them with confidentiality legends, but did not always get them back. The district court held that this widespread distribution defeated secrecy as a matter of law. Judge Posner, writing for the Seventh Circuit, reversed: whether Rockwell's precautions were reasonable was for the jury, and the answer depended on the balance between the costs and benefits of further precautions. Sharing secrets with vendors is normal; doing so under legends and access limits can be reasonable even if the controls are imperfect. An enterprise AI provider is, functionally, one more vendor that receives drawings.

Learning Curve Toys, Inc. v. PlayWood Toys, Inc., 342 F.3d 714 (7th Cir. 2003), confirmed that reasonable measures for a small company look different from those for a large one. PlayWood, a small Canadian company, disclosed a toy-track design at a meeting after asking that it be kept confidential, without a written agreement. The Seventh Circuit reinstated a jury verdict for PlayWood, applying the Restatement factors and emphasizing that the inquiry is contextual. For AI, this means a five-person startup does not need a security operations center. It does need an actual rule that is actually followed.

Yellowfin Yachts, Inc. v. Barker Boatworks, LLC, 898 F.3d 1279 (11th Cir. 2018), is the warning. A boat maker's vice president of sales kept customer and pricing information on his personal laptop and phone with the company's encouragement and without meaningful restrictions, and the company took no effective steps to retrieve it when he left. The Eleventh Circuit affirmed summary judgment for the defendants: a company that lets an employee store its supposed secrets on unsecured personal devices, without restriction, cannot persuade a reasonable jury that it took reasonable measures. Substitute "personal chatbot account" for "personal laptop" and the case maps onto a large share of current corporate practice.

InteliClear, LLC v. ETC Global Holdings, Inc., 978 F.3d 653 (9th Cir. 2020), shows the owner's side. The Ninth Circuit reversed summary judgment against a software company that had used confidentiality agreements with its licensees and limited access, holding that reasonable measures and the precise identification of the secrets were triable issues. It also held that a plaintiff must identify the trade secrets with sufficient particularity, which is where AI questions reappear in discovery. Identification practice is covered in Identifying Trade Secrets in Litigation: Reasonable Particularity, Sequencing Discovery, and Protecting the Secret While You Sue.

How defendants use AI facts against the owner

A defendant attacking reasonable measures will ask, in discovery and at deposition:

whether the owner had a written AI policy, when it was adopted, and whether employees acknowledged it;
which tools employees actually used, under which account types and terms, and whether the owner knew;
whether the claimed secrets, or documents containing them, were ever submitted to an AI service, and under what terms;
whether the owner blocked unapproved tools, logged use of approved ones, or ever disciplined anyone for violations;
whether the owner's own executives used consumer tools for confidential work.

The strongest version of the argument is not "the secret leaked through the AI." It is "this company did not care." A defendant who can show that the owner allowed employees to paste anything into any tool, never checked, and treated the claimed secret no differently from marketing copy has a credible case that the information was never the subject of reasonable measures. That is why AI governance belongs in the trade secret program rather than in a separate technology silo. The broader program is described in Building a Trade Secret Protection Program from Scratch and its cloud and remote-work dimensions in Trade Secrets in the Age of Remote Work and Cloud Computing.

How owners answer

Owners answer with a record. The most persuasive records show five things: an approved tool under business terms with confidentiality and no-training commitments; a written policy that classifies data and says what may go where; technical controls that make the policy real, such as single sign-on, blocking of unapproved tools, and data loss prevention rules; training and acknowledgments; and enforcement, meaning that violations were noticed and addressed. A single incident, promptly contained and investigated, is consistent with reasonable measures. A pattern of tolerated violations is not.

Vendor terms: reading what the contract actually promises

The four tiers

Most major providers sell the same underlying models through several channels with very different terms. The labels vary by provider and change often, so the categories below describe common patterns rather than any one company's current contract. Always read the version that governs the specific account.

Tier	Typical training default	Typical retention	Human review	Contract posture
Free or paid consumer app	Content may be used to improve models unless the user opts out (and some providers changed consumer defaults during 2025)	Conversation history kept until deleted, sometimes longer for safety or legal reasons; opted-in training data may be kept for years	Possible for safety, abuse, and quality review	Click-through terms; provider's privacy policy governs; no negotiated confidentiality
Business or enterprise workspace	Customer content not used for training by default	Admin-configurable retention; deletion on request or after a set period	Limited, usually for abuse investigation, under access controls	Commercial terms, data processing addendum, confidentiality clause, security commitments, sometimes audit reports
API platform	Customer content not used for training by default	Inputs and outputs often kept for a limited period (commonly around 30 days) for abuse monitoring, then deleted	Limited, for abuse or safety flags	Commercial terms and DPA; customer controls the application layer
Zero data retention or equivalent	No training	Inputs and outputs not stored after the response, subject to stated exceptions	Generally none, because nothing is retained	Special approval or contract amendment, often limited to eligible use cases and endpoints

Two cautions apply to any such table. First, "we do not train on your data" is not the same as "we do not keep your data" or "no human will see your data." Each promise has to be found separately. Second, the most protective tier is only as good as the account the employee actually logged into. An enterprise license does not help when an employee uses the consumer version of the same product from a personal account on a work laptop.

Clause by clause

A careful review of AI vendor terms for trade secret purposes covers at least these points:

Definition of customer content. Does it include inputs, uploaded files, outputs, embeddings, fine-tuning data, and logs? Outputs and embeddings are sometimes omitted, leaving the provider's rights unclear.
Use restrictions. Is use limited to providing and securing the service? Is "improving the service" defined so broadly that it permits training?
Training and opt-out mechanics. Is the no-training commitment contractual, or only a setting the provider can change? Does it cover affiliates and subprocessors?
Retention and deletion. What is retained, for how long, and where? Does deletion reach backups and abuse-monitoring stores? What happens under a legal hold or court order?
Human access. Who at the provider may access content, for what reasons, with what logging, and from which countries?
Subprocessors and connectors. Is there a published list with notice of changes? Are third-party plug-ins, connectors, or tools covered by the same terms, or does data leave the contract when a user enables one?
Confidentiality. Is customer content defined as the customer's confidential information, with a standard of care and remedies for breach?
Security. Encryption, access controls, certifications or audit reports, breach notification timing, and cooperation in investigations.
Unilateral changes. Can the provider change the terms by posting new ones? Does the customer get notice and an exit right?
Output rights and indemnities. Who owns outputs, and does the provider indemnify for third-party claims? These are less about secrecy and more about ownership, covered in Licensing Data and Models for Artificial Intelligence: Training Rights, Outputs, and Indemnities.

Procurement teams already handle much of this list. The AI Vendor Procurement and Governance Checklist: A Practical Checklist covers the commercial side; the trade secret lens adds a specific question for each term: if this clause were read aloud at a deposition, would it sound like an assurance of confidentiality or like a release?

Regulators and unilateral changes

Providers' promises are also enforceable by regulators. Section 5 of the FTC Act, 15 U.S.C. § 45, prohibits unfair or deceptive practices, and FTC staff warned in early 2024 that AI companies that quietly change their terms to permit training on previously collected data, or that fail to honor confidentiality commitments to business customers, may violate it. That warning protects customers, but it is no substitute for contract rights. For financial institutions, the FTC Safeguards Rule, 16 C.F.R. Part 314, requires oversight of service providers that handle customer information, which includes AI providers. The broader regulatory picture is in Cybersecurity Regulation for Businesses: The FTC Safeguards Rule, NYDFS Part 500, SEC Cyber Disclosure, and State Laws.

Court orders can override retention promises

Retention commitments are subject to the law. In 2025, in the consolidated copyright litigation brought by news publishers against OpenAI in the Southern District of New York, a magistrate judge ordered OpenAI to preserve output logs that it would otherwise have deleted. According to OpenAI's public statements, the order reached consumer conversations and API content not covered by zero-retention arrangements, and it was later narrowed so that the ongoing obligation ended in the fall of 2025 while data already preserved remained held. Whatever the final shape of that order, it teaches a general lesson. A provider's deletion promise yields to preservation duties in litigation, including litigation to which the customer is not a party, and the preserved data may be reviewed under a protective order by lawyers and experts the customer never chose. Only content that is never retained avoids that risk.

The new leakage paths

The popular image of AI leakage is a model blurting out someone's secret to a stranger. In practice, the more common paths are mundane.

Prompt and output logs

Every conversation is a record. It sits in the provider's systems, in the user's history, in any observability or logging tool the company's developers put in front of the API, and sometimes in browser sync. Logs are discoverable, breachable, and easy to forget. Engineering teams that build on AI APIs often route traffic through third-party gateways or monitoring services that capture full prompts and responses, creating a second copy outside the AI contract.

Sharing features and public assistants

Many tools let users share a conversation by link or publish a custom assistant with uploaded files. Shared links have been indexed by search engines when users did not realize the links were public, and researchers have shown that instructions and knowledge files behind some public custom assistants can be extracted by asking the right way. Each is a publication risk under the internet-posting cases.

Retrieval-augmented generation that ignores permissions

Retrieval-augmented generation (RAG) lets a model answer questions by searching an internal document store. If the retrieval index was built from a shared drive without carrying over each document's access controls, the assistant becomes a way for any employee to read documents they could never open directly. That is an internal access-control failure, and it matters for trade secrets because need-to-know access is one of the measures courts look for. An index that flattens permissions erases that measure.

Agents and connectors

Agentic tools act: they read email, browse, open files, call APIs, and write code. A connector that gives an assistant access to a mailbox or drive gives it, and anyone who can steer it, the same access. When an agent can both read sensitive data and send information outward, a single malicious instruction can turn it into an exfiltration channel.

Prompt injection

Prompt injection is the attack that makes agents dangerous. A model cannot reliably distinguish the user's instructions from instructions embedded in the content it processes. A web page, email, document, or code comment can carry hidden text telling the assistant to collect certain data and send it somewhere, for example by embedding it in a link or an image request. The OWASP Top 10 for Large Language Model Applications lists prompt injection as the leading risk and, in its 2025 edition, added system prompt leakage as a separate category; NIST's work on adversarial machine learning describes the same class of attacks. No current technique eliminates prompt injection. The defensible approach is architectural: limit what an agent can reach, require human approval for outbound actions, and keep the most sensitive data out of agent-accessible stores.

Fine-tuning and memorization

Fine-tuning a model on proprietary data creates a model that has learned that data. If the fine-tuned model is then exposed to people who should not see the underlying data (customers, contractors, or the public), memorization becomes a disclosure risk. The model weights themselves then deserve trade secret treatment.

Meeting bots, browser extensions, and shadow tools

Transcription bots that join calls, browser extensions that read every page to offer writing help, and personal accounts used on work devices all move data outside approved channels. They are the AI equivalent of the personal laptop in Yellowfin.

For the incident side of these risks, including how a security event can become a trade secret loss, see Cybersecurity Incident Response and IP Protection: Preventing Trade Secret Loss During Data Breaches.

Misappropriation with AI: improper means, reverse engineering, and extraction

AI-assisted reverse engineering is still reverse engineering

§ 1839(6)(B) codifies the Kewanee principle: reverse engineering and independent derivation are proper. A competitor that buys a product and uses AI tools to analyze its firmware, its chemistry, or its behavior is reverse engineering, and the speed of the tool does not change the legal character of the act. The limits come from elsewhere: contract terms that prohibit reverse engineering (which may be enforceable as contracts even though trade secret law allows the practice), anti-circumvention rules in 17 U.S.C. § 1201, and copyright in the code itself. The interplay between reverse engineering and copyright is the subject of Copyright in Software Interfaces After Google v. Oracle: APIs, Compatibility, and Reverse Engineering, and the discipline for doing it defensibly is in Running a Clean Room Software Development Project: A Practical Guide. A clean room that lets an AI model trained on a competitor's leaked code write the "independent" version is not a clean room.

Scraping at scale can be improper

Compulife Software Inc. v. Newman, 959 F.3d 1288 (11th Cir. 2020), is the most important case for AI-era data collection. Compulife's database of insurance rates generated individual quotes that anyone could get from its public website. The defendants used a bot to request millions of quotes and rebuild a substantial part of the database. The Eleventh Circuit held that even though any single quote was public, acquiring a large portion of the database by automated scraping could be improper means, and it vacated the judgment for the defendants. Compulife does not make all scraping unlawful, and the Ninth Circuit's decision in hiQ Labs, Inc. v. LinkedIn Corp., 938 F.3d 985 (9th Cir. 2019), reaffirmed after remand in 2022, held that scraping public profiles was unlikely to violate the Computer Fraud and Abuse Act. But it means that using AI agents to harvest a competitor's semi-public data at a scale the competitor plainly did not intend to permit carries trade secret risk independent of computer-crime law.

Computer-crime law after Van Buren

The Computer Fraud and Abuse Act, 18 U.S.C. § 1030, reaches access "without authorization" and access that "exceeds authorized access." Van Buren v. United States, 593 U.S. 374 (2021), adopted a gates-up-or-down reading: a person exceeds authorized access by entering parts of a system that are off limits, not by misusing information from areas they may enter. An employee who uses a permitted AI tool for an improper purpose is not committing a CFAA violation under that reading, though the conduct may still breach contract and trade secret duties. Defeating a technical barrier, such as using stolen credentials or a prompt-injection exploit to reach data the attacker is not authorized to see, can be a different matter.

Extracting a competitor's prompts

System prompts, the hidden instructions that shape how a deployed assistant behaves, have become a target. In 2025, OpenEvidence, a medical-information AI company, filed complaints alleging that competitors had posed as medical professionals to access its platform and used prompt-injection techniques to try to extract its system prompt, asserting trade secret and related claims. Those are allegations that no court resolved on the merits, but they frame the question that courts will answer: whether tricking a model into revealing its instructions is "misrepresentation" or "espionage through electronic or other means" under § 1839(6)(A), or whether a prompt that a public-facing model can be induced to reveal was never adequately protected. Both can be true. An owner that wants to call a system prompt a trade secret should assume extraction attempts will occur, keep the most valuable logic out of the prompt where possible, monitor for extraction patterns, and bind users by terms that prohibit the attempt. Breach of those terms supplies the "breach of a duty to maintain secrecy" element, and the monitoring supplies the reasonable-measures record.

Departing employees with AI in hand

The classic departing-employee case now has an AI dimension in both directions. The employee may use AI tools to summarize and carry out large volumes of material quickly, and the employer's own AI history may be used to attack its claim. In WeRide Corp. v. Huang, 379 F. Supp. 3d 834 (N.D. Cal. 2019), an autonomous-driving company obtained a preliminary injunction against a former engineer and the competitor he joined, based on evidence of downloads and deletions before departure; the court later imposed terminating sanctions for destruction of electronic evidence. Waymo LLC v. Uber Technologies, Inc., the lidar dispute arising from an engineer's download of some 14,000 files before leaving Google's self-driving unit, produced published rulings on arbitration and on the displacement of other state-law claims by California's trade secret statute (256 F. Supp. 3d 1059 (N.D. Cal. 2017)) and settled during trial in 2018; the engineer later pleaded guilty to a criminal trade secret charge and was subsequently pardoned. Neither case involved generative AI, but both are the models for AI-era disputes because the evidence was forensic: what was downloaded, when, to where, and what was deleted.

The criminal side is active. In 2024, federal prosecutors in California charged a former Google software engineer, Linwei Ding, with stealing confidential information about the company's AI supercomputing infrastructure while secretly working with companies in China; according to the government, he copied information into notes files and converted them to PDFs before uploading them to a personal account, a method chosen to avoid detection. A superseding indictment in 2025 added economic espionage counts under § 1831, and in January 2026 a federal jury convicted him on all seven economic espionage counts and all seven theft counts. The allegations show that AI infrastructure itself, not just AI-assisted work, is now a trade secret target. The departing-employee controls that matter most are collected in the Employee Departure Trade Secret Protection Checklist: A Practical Checklist.

"Use" is broad

Defendants sometimes argue that feeding a secret into a model is not "use" if the model never outputs it. The argument is weak. In Oakwood Laboratories LLC v. Thanoo, 999 F.3d 892 (3d Cir. 2021), the Third Circuit read "use" in the DTSA broadly, following the Restatement's view that any exploitation of the secret likely to injure the owner or enrich the defendant qualifies, including using it to guide research and development or to accelerate a competing product. Training or fine-tuning a model on a misappropriated dataset, or using a misappropriated system prompt as the starting point for one's own, fits comfortably within that definition. Damages for that kind of use are often measured by avoided development cost, the theory affirmed in Epic Systems Corp. v. Tata Consultancy Services Ltd., 980 F.3d 1117 (7th Cir. 2020), where consultants had used credentials to download a software company's confidential documentation from its customer portal.

What AI creates: prompts, weights, evaluations, and outputs as trade secrets

Why trade secrecy matters more for AI assets

The D.C. Circuit held in Thaler v. Perlmutter, 130 F.4th 1039 (D.C. Cir. 2025), that the Copyright Act requires a human author, and the Copyright Office's January 2025 report on copyrightability (Part 2 of its AI report) concluded that prompts alone generally do not give the user authorship of the output. Model weights are numbers produced by a training process, and their copyright status is unsettled. Patents may cover architectures and methods but require public disclosure. For much of what an AI team produces, trade secret law and contract are the realistic protections. The copyright side is covered in Copyright in AI-Assisted Works: Human Authorship, Thaler v. Perlmutter, and the Copyright Office Guidance, and the patent-or-secret choice in Provisional Patent Applications: What They Protect, What They Do Not, and How to Keep the Priority Date.

Asset by asset

Model weights. The clearest candidate. Weights are costly to produce, not readily ascertainable, and valuable precisely because they are not public. Reasonable measures mean access controls, encryption, logging of every copy, and contract terms with every host. Releasing weights openly ends protection for that version.
Training and fine-tuning datasets. A curated dataset can be a trade secret as a compilation even if individual items are public, the principle recognized for software combinations in Integrated Cash Management Services, Inc. v. Digital Transactions, Inc., 920 F.2d 171 (2d Cir. 1990). The value lies in the selection, cleaning, and labeling.
Evaluation sets and benchmarks. Private test sets that reveal how a model fails are valuable and easy to overlook. Once leaked, they are useless as tests.
System prompts and prompt libraries. Eligible, but the hardest to defend because they are exposed to every user of the deployed system. The more value a prompt carries, the more it should be protected by architecture (keeping logic server-side) rather than by hope.
Outputs. An output that embodies valuable, nonpublic information (a formulation the model helped optimize, a pricing analysis, a code module) can be a trade secret on the same terms as any other work product, regardless of whether a human or a model drafted it.

Identification is where these claims succeed or fail. A plaintiff that claims "our prompts" without saying which prompts and what about them is secret will meet the particularity rule applied in InteliClear and in Mallet & Co. v. Lacayo, 16 F.4th 364 (3d Cir. 2021), where the Third Circuit vacated a preliminary injunction because the district court had not identified the trade secrets with enough specificity.

Development cost as evidence of value

Independent economic value can be shown by what it cost to develop the secret and what a competitor saved by taking it. In WeRide, the court relied on evidence of the time and money the plaintiff invested in its autonomous-driving technology. AI assets lend themselves to this proof: compute bills, labeling contracts, and engineering hours are documented. Keep those records. They prove value, and they also support a head-start injunction and an avoided-cost damages model.

Transparency regimes and trade secrets

Regulators increasingly require AI developers to disclose information about their models. The EU AI Act (Regulation (EU) 2024/1689) requires providers of general-purpose AI models to publish a sufficiently detailed summary of the content used for training, using a template from the European AI Office, and its recitals and confidentiality article acknowledge the need to protect trade secrets and confidential business information in that process. Similar tensions appear in state AI laws in the United States. Disclosure obligations are not misappropriation, but they shrink what can remain secret, and a company that must publish a training-data summary should decide in advance which details stay confidential and why. The governance side is covered in AI Governance and Compliance: Building a Program for the EU AI Act, State AI Laws, and Everything After.

The overlays: labor law, whistleblowers, and privilege

Confidentiality rules and the NLRA

An AI policy is a work rule, and work rules for non-supervisory employees are subject to the National Labor Relations Act. Section 7, 29 U.S.C. § 157, protects employees' right to engage in concerted activity for mutual aid or protection, including discussing wages, discipline, and working conditions, and Section 8(a)(1), 29 U.S.C. § 158(a)(1), makes it an unfair labor practice to interfere with that right. In Stericycle, Inc., 372 NLRB No. 113 (2023), the Board held that a facially neutral work rule is presumptively unlawful if an employee could reasonably read it to restrict protected activity, unless the employer shows the rule advances a legitimate and substantial interest that a narrower rule could not serve. In McLaren Macomb, 372 NLRB No. 58 (2023), the Board held that offering severance agreements with broad confidentiality and non-disparagement terms that restrict Section 7 rights is itself unlawful.

The risk for AI policies is a definition of "confidential information" broad enough to include compensation, staffing, schedules, or workplace complaints, combined with a rule that employees may not put "confidential information" into any external tool. An employee who uses a chatbot to draft a group complaint about pay could be disciplined under such a rule, and the rule itself becomes the violation. The cure is precision: define protected categories by reference to trade secrets and specific business information, and add an express statement that the policy does not restrict Section 7 activity. The Board's composition changed in 2025 and both decisions may be revisited, so check their current status before relying on either. The broader rules are in Union Organizing and the NLRA: What Employers May and May Not Do.

The DTSA immunity notice

18 U.S.C. § 1833(b) immunizes an individual who discloses a trade secret in confidence to a government official or an attorney solely to report or investigate a suspected violation of law, or in a sealed court filing. Employers must give notice of the immunity in any contract or agreement with an employee, contractor, or consultant that governs the use of trade secrets or confidential information, entered into or updated after May 11, 2016, or cross-reference a policy document that contains it. An employer that omits the notice cannot recover exemplary damages or attorney's fees under the DTSA against an individual who was not notified. Many companies roll out AI policies with new acknowledgment forms. If that form governs confidential information, it is an agreement that needs the notice.

Privilege, work product, and lawyers' own use

Lawyers face the same problem with a professional overlay. ABA Formal Opinion 512 (July 2024) addresses generative AI under the Model Rules: competence under Rule 1.1 includes understanding a tool's capabilities and risks; confidentiality under Rule 1.6 requires evaluating whether information will be disclosed to or accessed by others, and the opinion concludes that informed client consent is required before inputting client confidential information into a self-learning tool that may use it beyond the matter, with boilerplate consent in an engagement letter not enough. The opinion also addresses supervision, communication, candor, and fees.

Privilege raises a narrower question: does submitting privileged material to an AI tool waive privilege? Disclosure to an agent who helps the lawyer render legal advice, under conditions of confidentiality, generally does not waive, and enterprise tools with confidentiality terms look like other cloud services lawyers already use. A consumer tool whose terms permit training and human review looks more like disclosure to an outsider. Courts have addressed this only sparingly, so the conservative course is to treat consumer tools as off limits for privileged material. The corporate privilege framework of Upjohn Co. v. United States, 449 U.S. 383 (1981), still governs who is inside the privilege, and Fed. R. Evid. 502 limits the scope of waiver in federal proceedings and allows a court order that disclosure in the litigation is not a waiver. See Attorney-Client Privilege and Work Product for Businesses: Upjohn, In-House Counsel, and the Common Interest and Legal Ethics in Practice: Conflicts, Confidentiality, Fees, and the Duty of Technological Competence.

Prompts and outputs are discoverable

Prompts, outputs, and agent logs are electronically stored information under Fed. R. Civ. P. 34. Once litigation is reasonably anticipated, a party that lets an AI tool's retention setting delete relevant conversations risks sanctions under Fed. R. Civ. P. 37(e). Both sides in trade secret cases now ask for them: the owner to show what the defendant fed into a model, the defendant to show what the owner exposed. Protective orders under Fed. R. Civ. P. 26(c) and 18 U.S.C. § 1835, which directs courts to preserve the confidentiality of trade secrets and lets the owner be heard under seal before any disclosure is authorized, should address whether and how parties may use AI tools to review the other side's confidential material. A protective order that allows "attorneys' eyes only" material to be uploaded to a consumer chatbot defeats itself.

Practical implications for each side

For the owner of the secrets

Decide what is a secret before deciding what may go into AI. A classification scheme that names the crown jewels lets the AI policy be strict where it matters and permissive elsewhere.
Provide an approved tool. Prohibitions without an alternative fail; employees who need help will find it. An enterprise tool with a no-training commitment, configured retention, and single sign-on is the foundation.
Block and monitor the rest. Network and endpoint controls that block unapproved AI domains, data loss prevention rules for the highest-value data classes, and logs of approved tool use turn the policy into a measure.
Paper it. Update confidentiality agreements, the handbook, and contractor terms to address AI tools, with the § 1833(b) notice and an NLRA carve-out. Model language is in Drafting Enforceable Non-Disclosure Agreements for Technology Transactions.
Enforce and document. Investigate violations, record what was done, and keep the record. A contained incident helps; a forgotten one hurts.
Treat AI assets as secrets. Inventory weights, prompts, datasets, and evaluations; restrict access; log copies.

For the accused party

Test reasonable measures with AI facts. Ask for the policy history, tool inventory, logs, and incidents. Ask whether the claimed secrets were submitted to AI tools and under what terms. Under Fail-Safe, LLC v. A.O. Smith Corp., 674 F.3d 889 (7th Cir. 2012), an owner that shared information without asking for confidentiality could not later claim it took reasonable measures.
Test ascertainability. If a general-purpose model, prompted by someone without access to the secret, produces the claimed information or something functionally equivalent, that is evidence it is readily ascertainable. Document the prompts and outputs carefully and expect the owner to argue that the model was led.
Keep your own house clean. A defendant whose engineers fed the plaintiff's material into a model has a "use" problem under Oakwood and a preservation problem under Rule 37(e). Preserve the defendant's AI logs early and investigate before the other side does.
Document independent development. Contemporaneous records of prompts, sources, and iterations show independent derivation. The clean-room discipline in the Clean Room Toolkit: Protocols, Team Certifications, and Specification Records applies to AI-assisted development too.

For AI vendors and their counsel

Say what you do. Terms that clearly separate training, retention, and human access, with contractual commitments for business tiers, make customers' reasonable-measures arguments possible and reduce FTC exposure.
Plan for subpoenas and holds. Customers will want to know how the vendor responds to third-party subpoenas for their content and to preservation orders in unrelated litigation.

An extended worked example: Corvane Robotics

Return to Corvane, and run the story twice.

Version one: no program. Corvane sues its former principal engineer, Lena Strand, and her new employer, Talus Automation, under the DTSA and California law, claiming the grasp-planning algorithm and its training data as trade secrets. Discovery shows that Corvane had a two-page confidentiality policy from 2019 that never mentioned AI. Engineers used personal accounts on three different consumer chatbots, and at least one, the firmware engineer from the opening scene, pasted grasp-planning code into a tool whose terms at the time allowed training on user content unless the user opted out. Corvane cannot say whether he opted out. Its CTO used a consumer note-taking assistant to summarize design reviews. Talus moves for summary judgment on reasonable measures, citing Yellowfin and Fail-Safe, and argues that the algorithm's core approach is readily ascertainable because a general model, asked how to plan grasps on deformable objects, describes a similar technique.

Corvane has answers. The pasted code was a module, not the full algorithm. The algorithm's value lies in the specific parameters and the training data, neither of which was ever pasted. Under Rockwell, imperfect precautions are not fatal, and under Learning Curve, reasonableness is contextual. The generic model output describes a family of techniques published in the literature, not Corvane's implementation, and Tewari holds that public sources make information ascertainable only to the extent they actually disclose it. The court denies summary judgment on the algorithm but grants it on a set of design-review notes that the CTO had routinely run through a consumer assistant. Corvane goes to trial with a reasonable-measures fight it could have avoided and a jury question about its own carelessness.

Version two: a program. In this version, Corvane adopted an AI policy eight months before Strand's departure. It classified the grasp-planning code, parameters, and training data as Tier 1 (no external AI processing except in a self-hosted model on Corvane's infrastructure). It licensed an enterprise assistant with a contractual no-training commitment and 30-day retention for Tier 2 material, blocked consumer AI domains on company devices, and added data loss prevention rules that flag source code in browser uploads. Every engineer signed an updated confidentiality agreement with the § 1833(b) notice and an AI clause. When the DLP system flagged an engineer pasting a Tier 1 file into the enterprise assistant, security opened a ticket, the vendor confirmed the retention window, the engineer received retraining, and the incident report went into the file.

Strand's forensic record shows that in her last two weeks she ran 40 Corvane design documents through a personal AI account to produce summaries, then emailed the summaries to herself. Corvane's logs show the uploads from her work laptop because the DLP rule fired. Now the AI facts help Corvane: the policy and controls show reasonable measures; the incident record shows enforcement; and Strand's use of a personal account to process Tier 1 documents in violation of a signed agreement is breach of a duty of secrecy and evidence of acquisition by improper means under § 1839(6). Corvane moves for a preliminary injunction under Fed. R. Civ. P. 65, asking the court to order Strand to identify and preserve the personal AI account, produce the conversation history, and refrain from using the summaries; it does not ask the court to bar her from working at Talus, which § 1836(b)(3)(A)(i) would not allow on these facts. Talus, advised early, quarantines Strand from grasp-planning work and certifies that no Corvane material entered its systems. The case settles in four months.

The difference between the two versions is not the technology. It is whether Corvane could show a court that it treated its secrets as secrets in the places employees actually work.

Common mistakes

Banning AI and stopping there. A ban without an approved alternative produces shadow use the company cannot see, and a policy the company cannot enforce is evidence against it.
Buying the enterprise tier and assuming the problem is solved. Employees still use personal accounts, browser extensions, and meeting bots. The license is one control, not the program.
Reading only the training clause. Retention, human review, subprocessors, connectors, and unilateral changes matter as much.
Flattening permissions in a RAG index. An internal assistant that lets anyone read anything erases need-to-know access, one of the measures courts look for.
Granting agents broad connectors. Read access to email and drives plus outbound capability is an exfiltration channel waiting for a prompt injection.
Calling everything confidential. Overbroad definitions weaken the claim to any particular secret and invite NLRA challenges.
Forgetting the § 1833(b) notice in the new AI acknowledgment form.
Letting retention settings destroy evidence after a dispute is foreseeable.
Claiming "our prompts" without identifying them. Particularity rules apply to AI assets as much as to formulas.
Using AI to "independently" rebuild a competitor's product from material that was not lawfully obtained.

Frequently asked questions

Does putting a trade secret into ChatGPT or a similar tool destroy it? Not automatically. The answer depends on the terms that governed the account (training, retention, human review), whether the disclosure was authorized and limited, and what the owner did afterward. A one-time, unauthorized paste into a consumer tool, promptly addressed, is unlikely to end protection by itself, though it gives the other side an argument. Routine, tolerated use of consumer tools for the secret is a much bigger problem, mostly because of what it says about reasonable measures.

Is an enterprise AI tool safe for trade secrets? It can be, if the contract treats customer content as confidential, prohibits training, limits retention and human access, and binds subprocessors, and if the company controls who uses it and logs that use. For the most valuable secrets, many companies still prefer self-hosted models or zero-retention arrangements.

Can an AI vendor's model "remember" my data and tell a competitor? Training on your data creates some risk of memorization, which research has demonstrated for repeated or distinctive text, but verbatim regurgitation of a particular customer's secret is uncommon. The more realistic risks are logs, human review, breaches, and legal process. A no-training commitment addresses the first risk only.

Is a system prompt a trade secret? It can be, if it has independent economic value from not being known and the owner takes reasonable measures, which for a public-facing system means anticipating extraction attempts. Courts have not yet settled how much protection a prompt exposed to every user can claim, so keep the most valuable logic out of the prompt where possible.

Is it misappropriation to use AI to analyze a competitor's product? Not if the product was lawfully obtained and no contract prohibits it. That is reverse engineering, which the DTSA expressly treats as proper. It can become improper if it involves defeating technical barriers, breaching terms of service that bind the user, or large-scale automated harvesting of the kind Compulife addressed.

Can our AI policy forbid employees from discussing their pay with a chatbot? Be careful. A rule that a non-supervisory employee could reasonably read as restricting discussion of wages or working conditions risks an NLRA violation under the Stericycle standard. Define confidential information by reference to business secrets and include a Section 7 carve-out.

Do we need to update existing NDAs for AI? Usually yes. Older agreements often permit disclosure to "service providers" without addressing AI tools, training, or retention, and they may lack the § 1833(b) notice. An AI clause that restricts processing of the counterparty's information through AI tools except under approved terms closes the gap.

Takeaways

Treat every AI tool as a third-party recipient and ask whether the disclosure is limited, protected, and authorized.
Reasonable measures are judged on practice. Approved tools, blocked alternatives, logs, training, and enforcement make the record.
Read vendor terms for training, retention, human review, subprocessors, connectors, and change rights, and match the tier to the data class.
The common leaks are logs, links, permission-blind retrieval, agents, and shadow tools, not dramatic model regurgitation.
AI-assisted reverse engineering is lawful; deceptive extraction, barrier-defeating access, and abusive scraping may not be.
Protect AI assets (weights, datasets, evaluations, prompts) as trade secrets, with particular identification and development-cost records.
Draft policies and agreements that respect the NLRA and include the DTSA immunity notice.
Preserve AI logs when a dispute is foreseeable, and address AI tool use in protective orders.

This document is general information, not legal advice for any particular situation; the law and vendor terms change, and the facts matter.