How AI Agents Are Changing Trade Secret Risk

Seth Kugler, a partner at Grellas Shah LLP, argues that AI agents expand trade secret risk beyond the familiar scenario of an employee copying files. The concern is not only deliberate theft, but also employees exposing proprietary information through AI tools running on personal devices. For founders and company leaders, the key takeaway is that AI can turn internal data access into model-training and competitive-use risks much faster than traditional workflows.

The commentary describes a federal trade secrets case in the U.S. District Court for the Northern District of California involving allegations that a former senior employee used stolen trade secrets as training inputs to build an AI-enabled competing business. Kugler writes that once proprietary information is used to develop a machine learning model or train an AI agent, simply removing the original files may not resolve the problem. Companies should treat AI exposure as a potential ongoing risk, not just a document-control issue.

The article warns that desktop AI agents can scan files, create folders and ingest directory paths across a local hard drive, which can create risks when employees use personal laptops containing company IP. Kugler also notes that traditional digital discovery may be insufficient because AI tools can disperse, alter and recreate data in less obvious locations. The practical implication: companies relying on personal devices and routine IT audits may miss material AI-related exposure.

Kugler recommends strict agentic AI policies, including controls that isolate outside AI from company documents and restrict tools that can crawl local drives. He also advises eliminating remote access from unmanaged devices by moving toward secure cloud environments where files cannot be downloaded locally. Finally, companies should update Confidential Information and Invention Assignment Agreements to address AI use, model training inputs and machine-learning-related misappropriation.

If a company suspects an employee has taken data or misused it in an AI tool, the commentary says the first step should be immediate: cut off system access and retain counsel. Waiting for client losses or financial damage can leave the business exposed. The broader message is clear: AI makes proprietary data more vulnerable, so security, policy and legal documents need to match the new risk environment.