On Friday, Apple dropped bombshell news that it was suing OpenAI for trade secret theft, alleging that the company stole sensitive Apple data and made efforts to learn sensitive information when hiring former Apple employees.
In accusing OpenAI of stealing secrets about Apple's unreleased products, Apple revealed allegations that a former employee allegedly siphoned a large number of sensitive files from the company's shared network folders weeks after leaving Apple to work for OpenAI.
Apple said in its complaint that a former employee, a systems electrical engineer named Chang Liu, allegedly “exploited a rare and previously unknown authentication bug” to gain access to the company's network. The bug is classified as a zero-day vulnerability, meaning Apple didn't have time to fix it before it was exploited.
Apple said it has since fixed the bug and terminated access for employees upon learning of the “security breach.” Apple said in its complaint that the bug could have allowed “several others” to access data on its network, but cited a check of server logs and argued that Liu was the only person who exploited the bug to steal sensitive Apple information while not an employee.
Although the disclosure is not detailed, it highlights the challenges organizations face in protecting sensitive company data after employees are no longer on the job. Companies often move to immediately cut off further access for departing employees to prevent sensitive information from being inadvertently leaked. Companies that don't completely retire employee accounts may face future security flaws, data breaches, or malicious actions by disgruntled employees.
An Apple spokesperson did not respond to an email from TechCrunch with questions about the security vulnerability, how it was exploited, and when the company retired employee credentials.
“LOL…That's very funny.”
Apple alleged in its complaint that Liu exfiltrated “dozens of sensitive Apple hardware-related files” over several weeks when he was a new employee at OpenAI.
Apple said these files contain “detailed information about unreleased products, engineering presentations, technical specifications, and proprietary project data.”
The company alleges that Liu did not return an Apple-issued work laptop that he had previously used to access Apple's network, suggesting it was once able to send and receive files from Apple's internal systems. Liu allegedly claimed to have “another computer,” according to the complaint. While working at OpenAI, Liu allegedly abused the access of an acquaintance, Yu-Ting Peng. Yu-Ting Peng was an Apple employee at the time and later went on to work at OpenAI. Mr. Liu allegedly used Mr. Peng's Apple-issued work laptop “while she was still employed by Apple and he was not.”
Apple said that during February 2026, Liu “attempted to access Apple's network storage, a cloud-based file repository containing Apple's confidential engineering files, project documents, and other sensitive information.”
Liu is said to have discovered that “even after he left Apple, he still had access to Apple's network repositories, the result of a then-unknown authentication vulnerability.”
Apple did not explain the authentication “bug” that Liu allegedly used to access Apple's network. However, authentication bugs generally refer to flaws in the login process that allow inappropriate access to systems or data due to weaknesses in the way the login mechanism works or misconfigurations such as overly broad privileges or not retiring login credentials for former employees.
Apple says in its complaint that when it learned that Liu had compromised Apple's systems, he failed to report the bug to Apple as required by his employment contract and did not return his Apple-issued work laptop.
The complaint added that Liu also failed to “remove programs that he authorized to access” Apple's network. The company did not say what programs or apps Liu allegedly used to access Apple's systems. It's not uncommon for employees to use work-approved tools like VPNs and remote viewing apps that allow them to use their credentials to access sensitive data from outside the company's offices.
Given that Liu was previously granted credentials to Apple's network as an employee, TechCrunch asked when Apple would remove Liu's access, but did not receive a response.
Once Mr. Liu gained access to the network share, he wrote to Mr. Peng: [network storage]very interesting. ”
Apple filed suit in the U.S. District Court for the Northern District of California in San Jose, requesting a jury trial. OpenAI has previously said it is “not interested in the trade secrets of other companies.”
If the lawsuit moves forward, it could begin this year.
If you buy through links in our articles, we may earn a small commission. This does not affect editorial independence.