A Former Employee Built an AI Clone of His Boss With Stolen Data

By James Calloway

A California federal court has granted a restraining order and preliminary injunction against a former senior employee who used stolen trade secrets to train an AI agent — a tool the court itself called an "existential threat" to the victimized business. The case, litigated in the U.S. District Court for the Northern District of California, marks a sharp departure from the classic trade-secret scenario of an employee walking out with client lists on a thumb drive.

The defendant, an ex-employee of a marketing agency with roughly six months of industry experience, attempted to skip the years normally required to build service expertise. According to attorney Seth Kugler of Grellas Shah LLP, who litigated the case for the plaintiff, the defendant used stolen proprietary documents as training inputs to build, in effect, "an AI version of his old boss."

That detail matters because it reverses the usual economics of competition: expertise that once took years to accumulate can now be approximated, at least in part, by a model trained on someone else's data.

What did the defense argue — and why did it fail?

The defense claimed no harm had occurred. The stolen documents sat in a "quarantine folder," and no clients had yet been poached. The court rejected this reasoning outright, granting emergency relief.

Kugler's explanation is the case's most consequential lesson: once a trade secret trains a machine learning model, containment is largely illusory. Even if the raw source files are scrubbed clean, a defendant struggles to prove the AI does not behave as it does because it once ingested the proprietary data. The contamination, once it happens, is effectively irreversible — at least as a matter of proof in court.

The caveat cuts both ways. What the ruling establishes is that a quarantine folder is insufficient; what it does not yet establish, as a single district court decision, is how far-reaching the doctrine will become in other jurisdictions.

Why do personal devices change the risk?

The more subtle threat, Kugler argues, is inadvertent rather than malicious. Startups routinely let employees work from personal laptops under standard Confidentiality Information and Invention Assignment Agreements. Unlike browser-based AI tools, desktop AI agents can scan files, create folders and ingest directory paths across a local hard drive without special permission or user alerts.

The exposure could be enormous: Kugler estimates thousands of employees may already be unknowingly breaching confidentiality agreements this way. If settings permit model training on that data, courts could eventually rule the trade secrets lost protection through dissemination — meaning the victim company forfeits legal cover, not just the data itself.

That figure is an assertion, not a measurement; no methodology accompanies it. But the underlying mechanism — agents indexing local drives by default — is verifiable in product documentation.

What should companies actually do?

Kugler recommends three steps, each tied to a specific vulnerability the case exposed:

• Strict agentic AI policies. Isolate outside AI from company documents. Web-based tools with firm data-privacy commitments, such as Claude, carry less risk than open-source or desktop applications that crawl local drives. Some agents, he argues, should not run at all in environments holding trade secrets.
• No remote access from unmanaged devices. Move work into a closed cloud environment where data can be viewed and edited on a secure server but never downloaded locally, removing the surface desktop agents can index.
• Rewrite confidentiality agreements for the AI era. Standard agreements need explicit clauses on AI use, model training inputs, and a precise definition of misappropriation through machine learning.

One more operational note: standard IT audits are no longer sufficient. AI tools make it trivial to disperse, alter and recreate data across nonobvious folder paths, and AI lowers the friction of reverse-engineering software, erasing telltale signs of copying. Full forensic imaging of personal devices — once considered overkill — is now the minimum. Proving theft in AI contexts demands intensive technical expert analysis and carries far more uncertainty than traditional IP litigation.

For founders who suspect misuse, Kugler's advice is immediate: cut off all system access and retain counsel before client losses materialize, since feeding trade secrets into AI poses a threat from day one. Expect courts, vendors and insurers to keep refining these boundaries as agentic AI spreads through the workplace.