Apple says former employee exploited ‘rare’ bug to download confidential files after leaving for OpenAI

In a startling legal development, Apple has announced a lawsuit against OpenAI, alleging that the tech company unlawfully accessed its trade secrets. The lawsuit claims that a former Apple employee, who transitioned to OpenAI, exploited a significant security vulnerability to download sensitive information weeks after his departure. The individual in question, Chang Liu, worked as a system electrical engineer at Apple. According to the complaint, Liu allegedly took advantage of a rare authentication bug that allowed him to breach Apple's shared network folders. This vulnerability, categorized as a zero-day exploit, had not been identified by Apple prior to its misuse. Apple has since patched the vulnerability and cut off Liu's access to its systems upon discovering the breach. The complaint suggests that while the flaw could potentially have been exploited by a few others, only Liu is accused of taking advantage of it to extract confidential data while no longer employed by the company. The legal filing raises critical concerns regarding corporate data security after employee departures. Organizations often strive to sever access for outgoing employees promptly to safeguard sensitive information from potential leaks. Failure to do so can result in severe security risks, including data breaches or malicious actions by former staff members. In the lawsuit, Apple asserts that Liu downloaded numerous confidential files over several weeks, which included crucial information about unreleased products, technical specifications, and engineering presentations. Additionally, Liu is said to have retained his work laptop, which may have been used to facilitate access to Apple's internal systems. Liu allegedly misused the credentials of another acquaintance, Yu-Ting Peng, who was still employed by Apple at the time. Reports indicate that Liu attempted to access Apple's network storage in February 2026, having discovered that he could still connect to the company's network, thanks to the undetected authentication vulnerability. Despite being aware of his unauthorized access, Liu reportedly did not inform Apple of the security flaw nor return the laptop he had been issued. He also failed to delete the program that enabled his access to Apple's network. The situation highlights the potential risks associated with employees retaining access to sensitive company data after their employment ends. Apple's lawsuit, filed in the U.S. District Court for the Northern District of California, calls for a jury trial. OpenAI has responded by asserting its commitment to not pursuing other companies' trade secrets, as the case is poised to unfold in the coming year.