Apple sued OpenAI on Friday. The headline write-up makes it sound simple: a poached engineer, a security bug, stolen trade secrets, a hardware business built on stolen foundations. Read the complaint and it gets messier fast — messier in the way these stories always do, which is itself worth sitting with before you decide who's the villain.
What Actually Happened
Chang Liu spent eight years at Apple working on some of its most sensitive product-development programs before leaving for OpenAI in January. He should have returned his Apple-issued laptop. He didn't, and on February 9 he found an authentication bug — unknown to Apple at the time — that let him keep reaching Apple's shared network folders after his termination.
Instead of reporting it, Apple alleges, he used it. Over several weeks, while building hardware for OpenAI, he downloaded dozens of confidential files: unreleased-product details, engineering presentations, technical specs, a presentation on Apple's circuit boards Apple calls "invaluable to anyone developing hardware." His message to a still-employed Apple colleague, Yu-Ting "Alyssa" Peng, about the discovery: "I found out I can access the [network storage], so funny. LOL."
Apple says the bug got patched fast once they found the messages, and that other users exposed to it don't appear to have touched anything. That's not the center of the complaint, though. The center is the allegation that Liu and Peng's exchange is "the tip of the iceberg" — evidence of a broader recruiting operation run by Tang Tan, a 24-year Apple veteran, former VP of iPhone product design, and now OpenAI's chief hardware officer. Apple claims Tan used insider knowledge — project code names, internal process — to get Apple staff to reveal unreleased-product details in job interviews, built a checklist to help departing employees dodge Apple's security controls, and ran "show and tell" sessions where employees allegedly brought in Apple hardware for informal disclosure. Apple says it's lost more than 400 employees to OpenAI and wants the court to shut down any use of what walked out the door with them.
Nobody in This Story Is Clean
Here's the case for Apple screwing this one up: a laptop that should have been returned, wasn't. A bug in access controls, live for weeks, that Apple didn't catch until it went looking through an ex-employee's messages for other reasons. Security failures like that don't happen to companies with airtight offboarding. And the Wall Street Journal's reporting adds a real wrinkle — bringing hardware to a job interview is common practice in this industry, and it's entirely possible some of what Tan's alleged "show and tell" sessions covered was information that reverse-engineering would have surfaced anyway. Litigation is also a tool. Slowing down a competitor's hardware roadmap, or making its recruiting pipeline radioactive, is a legitimate strategic outcome of a lawsuit whether or not the underlying claims fully hold up in court.
Here's the case against OpenAI: a company that markets itself on a mission statement gets caught, on its own former employee's messages, mocking the company he was raiding. A chief hardware officer allegedly coaching people on how to extract information in interviews and evade security review on the way out. Four hundred-plus hires from one competitor is not incidental headhunting — it's a strategy, and strategies get built on purpose. "We have no interest in other companies' trade secrets," says the OpenAI spokesperson. Sam Altman says he's not afraid of Apple. Neither statement addresses what's actually alleged, which is a pattern, not a single bad actor.
Both of those readings are plausible. That's not me dodging the question — it's the actual state of the evidence right now. Apple hasn't always finished these fights in court. It settled a long, expensive war with Samsung in 2018 and dropped a chip fight with Nvidia in 2023. A filed complaint is a set of allegations, not a verdict.
The Part That Actually Matters
The part worth paying attention to isn't who's guilty in this specific case. It's that we've all seen this movie before, and we'll see it again. Big company loses its security discipline somewhere it can't afford to. Ambitious competitor pushes past whatever line separates "aggressive recruiting" from "coordinated extraction." Everyone litigates in headlines before anyone litigates in a courtroom, and the actual facts — the ones a jury or a judge will eventually weigh — take a back seat to a story that's easier to tell.
This is Silicon Valley's most recurring genre, and the AI hardware race just gave it a new cast. If you're building anything with real access controls, real departing employees, or real competitors circling your talent pool, this is your reminder that the bug always gets found eventually, the messages always get read eventually, and "so funny, LOL" is not a defense anyone survives.
— J.P. Howlett
Related:
- Would You Give This to an Employee? — the access-control failure at the center of this lawsuit is the exact question this piece asks you to answer before you're the one explaining an unpatched bug to a courtroom.
- Open Foundation, Proprietary Application — the same extraction question, one layer up: who actually owns what gets built on shared ground.
Sources