Apple Claims Ex-Employee Leveraged ‘Uncommon’ Vulnerability to Access Sensitive Files After Joining OpenAI

On Friday, Apple announced that it is taking legal action against OpenAI, accusing the company of misappropriating trade secrets. Apple alleges that OpenAI illegally accessed its confidential information and actively sought to gain proprietary knowledge while hiring former Apple employees.

The lawsuit claims that a former Apple engineer took a significant amount of sensitive data after transitioning to a role at OpenAI. This individual is said to have accessed confidential information about Apple’s unreleased products by exploiting a security flaw shortly after leaving Apple.

According to the legal documents, Chang Liu, the former Apple electrical engineer, allegedly took advantage of a previously unidentified authentication vulnerability that permitted him access to Apple’s network. This vulnerability is categorized as a zero-day exploit, indicating that Apple was unable to remedy the issue before it was exploited.

Apple has since rectified the vulnerability and revoked Liu’s access upon discovering this breach. The company indicated that the flaw might have allowed a limited number of individuals to gain access to the network, but insisted that only Liu took advantage of it to steal confidential data based on server log investigations.

This situation emphasizes the difficulties organizations face in safeguarding sensitive information after employees depart. Many companies aim to immediately restrict access for leaving staff to prevent any potential data leaks—however, failure to thoroughly revoke access can lead to security breaches or intentional data theft.

Apple representatives did not respond to inquiries regarding the security vulnerability or the timeline of Liu’s credentials decommissioning.

“LOL… so funny.”

The complaint asserts that Liu managed to transfer numerous confidential files pertaining to Apple’s hardware during his initial weeks at OpenAI.

These files allegedly included in-depth details about unreleased products, engineering materials, technical specs, and proprietary project information. Apple claims Liu has not returned the laptop issued to him, suggesting that it could still transfer files to and from Apple’s internal systems. The complaint also notes that Liu stated he possessed “another computer.” Furthermore, while employed at OpenAI, he is accused of misusing the access granted to another acquaintance, Yu-Ting Peng, who was still an Apple employee at the time and later joined OpenAI. Liu reportedly used Peng’s Apple-issued laptop without authorization.

Apple alleges that in February 2026, Liu attempted to access Apple’s cloud-based storage, which contains confidential engineering files and other proprietary data.

Liu had allegedly discovered that he retained unauthorized access to Apple’s network due to the aforementioned security flaw.

While Apple did not elaborate on the specific authentication flaw exploited by Liu, such bugs generally pertain to issues in the login framework that could allow inappropriate access to data or systems due to weaknesses or misconfigurations.

In the lawsuit, Apple states that Liu, once aware of his unauthorized access, did not fulfill his duty to report the vulnerability nor did he return the company laptop. Moreover, the complaint notes that Liu neglected to remove the program that enabled him to access Apple’s network.

Unsurprisingly, it’s common for employees to have tools, such as approved VPNs or remote applications, facilitating access to sensitive data from outside company premises using their credentials.

As Liu was previously allowed access to Apple’s network as an employee, Apple has not yet disclosed when Liu’s credentials were officially revoked.

Upon allegedly regaining access to the network, Liu informed Peng, “LOL, I found out I can access the [network storage], so funny.”

Apple’s lawsuit has been filed in the U.S. District Court for the Northern District of California, and the company is seeking a jury trial. OpenAI has previously stated that it has no intention of using another company’s trade secrets.

If the case moves forward, it could begin later this year.