Apple wants a federal judge to stop OpenAI before discovery, before a jury, before any finding of liability. The complaint is sealed. The press release is not. "Immediate injunction" is the legal equivalent of a kill switch — a declaration that the damage is happening right now and no amount of money will repair it later.
I have spent a decade dissecting crypto projects that promised trust and delivered exposure. I traced 185,000 BTC through Alameda's wallet web. I audited order-matching contracts where a single integer overflow would have drained millions. I watched Celsius burn its own balance sheet while its PR team swore it was solvent. This case gives me the same feeling. The architecture of trust, engineered for failure.
The failure here is not whether one engineer leaked an API design. The failure is structural. The courts still model trade secrets as discrete files locked in a vault. A neural network is not a vault. It is a furnace. Feed it a secret and the secret does not remain a file. It becomes a probability, distributed across billions of weights. You cannot revoke a gradient. You cannot un-train a weight. That is the dilemma sitting underneath Apple's injunction request.
Apple and OpenAI are both California corporations. That single legal anchor decides more of this case than any dramatic court hearing. California is the state that abolished non-compete agreements. California courts have long refused to adopt the inevitable disclosure doctrine — the theory that a former employee's new job necessarily leaks the old employer's secrets. If Apple cannot point to a specific act of misappropriation, the injunction dies on the vine.
Two statutes control the battlefield. The Defend Trade Secrets Act, 18 U.S.C. section 1836, provides federal jurisdiction and a powerful procedural tool: an ex parte seizure order. The California Uniform Trade Secrets Act, Civil Code section 3426, provides the state-law claims. Both statutes define misappropriation similarly. Both require the plaintiff to prove it took "reasonable measures" to protect the secret. Apple's security apparatus is robust — that part is easy. The hard part is proving what OpenAI did with the information.
There is a structural mismatch between these statutes and the technology they are being asked to govern. DTSA was passed in 2016, when AI meant recommendation algorithms and voice assistants. The drafters did not contemplate model weights as a vector for misappropriation. The definitions, however, are elastic: a trade secret is information that derives independent economic value from not being generally known, and that is subject to reasonable efforts to maintain secrecy. A training dataset easily falls within that definition. So does the derived model itself, arguably. The legal system will therefore bend old words to fit new realities — the question is whether the fit is honest or performative.
An "immediate injunction" means a temporary restraining order or a preliminary injunction. The governing standard is the Winter test: likelihood of success on the merits, irreparable harm, balance of equities, and public interest. Courts apply that test with particular suspicion when the order would halt an ongoing business. Apple must show not only that its secret was taken, but that OpenAI is actively using it or will use it imminently. In a normal trade secret case, "use" means running code, selling a product, filing a patent. In an AI case, "use" is buried inside a training run — invisible, continuous, and almost impossible to timestamp.
There is a procedural irony Apple's lawyers already understand. If Apple invokes DTSA, it must file a trade-secret confidentiality statement under seal, describing its secret with specificity. That means Apple's crown jewels go into the court record. In a case about secrecy, the plaintiff must begin by defeating its own security. In crypto terms, it is the equivalent of proving you control a wallet by revealing the private key's checksum — you expose what you hold even while asking the court to protect it.
The press-release framing is also a negotiation tactic. Apple could have moved ex parte, without notice, for a surprise TRO. It did not. It filed publicly. That is not the behavior of a party seeking a kill shot. It is the behavior of a party sending a signal: license this technology now, or live inside a discovery machine for two years. This case is not merely about an injunction. It is about term sheets dressed up as legal papers.
On the public-interest factor, OpenAI will argue that an injunction against a frontier AI system harms competition and public access to technology. Apple will reply that protecting intellectual property is itself a public interest. But underneath the rhetoric, the fourth Winter factor has become a question about the future of AI development. Courts are being asked to take sides in a policy war without the authority to make policy. That is a recipe for a narrow, fact-specific ruling. And a narrow ruling is the one outcome that gives no one certainty.
The evidence problem. You cannot grep a neural network. You cannot run a checksum on a concept. A trained model is a matrix of floating-point numbers, and the information embedded in that matrix is entangled beyond any simple recovery. In a smart contract audit, I can point to a line of bytecode and say, "this overflows." In AI forensics, no one can point to a weight and say, "this is Apple's secret." The evidence that exists is circumstantial: a former employee, an email, a download log, perhaps a matching pattern in OpenAI's outputs. But none of that clears the high bar for an injunction.
The irreparable harm paradox. Trade secret law treats secrecy as the asset. The moment the secret is published, the asset is gone; courts call that irreparable harm. Here is the paradox OpenAI will exploit: if the secret has been absorbed into a model, it has not been published. It has been transformed. OpenAI's defense will argue that no output from its API reproduces Apple's secret, that no inference leaks it, and that the secret remains secret in the only sense that matters. That argument sounds like a lawyer's trick. It is also technically sound. The threat of disclosure is diffused across a latent space, which means the traditional conception of irreparable harm no longer maps onto the underlying technology.
The nuclear option problem. Suppose the judge grants the injunction. What does it actually enjoin? "Stop using Apple's trade secrets." How is OpenAI supposed to comply? It cannot delete a concept from a language model. It could delete a checkpoint, but that destroys unrelated capabilities and months of work. The judge becomes a technical project manager — a role courts have never been equipped to play. This is why software cases with executable remedies are the exception, not the rule. The unexecutable remedy is the defendant's quiet leverage. OpenAI can always say, "we have done our best, and we cannot do better."
The regulatory tail. Outside the courtroom, the enforcement machine is already turning. The Department of Justice has taken a growing interest in AI-related trade secret theft. A civil injunction is an ideal predicate for a criminal referral. The International Trade Commission can use Section 337 to block imports of products built on stolen secrets. Apple's motion is therefore not just litigation; it is a regulatory escalation. It tells every investor in AI infrastructure that data provenance is a liability, not an afterthought. The EU and other jurisdictions are watching too.
The discovery writ in disguise. The public story is about the injunction. The private story is about discovery. If Apple survives the TRO phase, it will demand training data provenance: dataset versions, checksums, access logs, personnel changes, fine-tuning runs involving Apple-related data. That discovery request is the sharpest scalpel in the case. OpenAI must either comply — exposing internal hygiene that may be less than pristine — or resist, which looks like concealment. Either outcome damages OpenAI's regulatory narrative. In crypto, we saw the same pattern in the Celsius collapse: the balance sheet was opaque, and when discovery forced it open, the opacity itself became evidence.
The compliance cost cascade. Even a successful defense is expensive. OpenAI's legal bill will run tens of millions of dollars. It will need clean teams, data isolation experts, external monitors, and a provenance documentation system. That system will eventually become the industry standard. Crypto learned this lesson after Mt. Gox and Celsius: if you cannot prove where the assets came from, you cannot prove they are safe. The AI industry is about to learn it for training data. "Know your data" is the new "know your customer."
The clean-room fantasy. OpenAI will present a clean-room defense: we ask new employees to sign declarations, we have internal policies, we do not accept misappropriated data. That is the industry standard. It is also unverifiable without a technical audit. A clean room is a process, not a property. And process is easy to fake — a policy document costs nothing to write, while actual compliance is a culture. I have been inside DeFi audits where the security report was pristine and the code was a catastrophe. The gap between documented process and real operation is where all serious failures live. OpenAI may be different. But "may be" is not a defense.
The human vector. Trade secrets do not flow through wires; they flow through people. If Apple's case is built on a former engineer, that engineer may become a co-defendant. Slack messages, server access logs, SSH timestamps — all of it enters discovery. In my forensic work, the decisive evidence is rarely the code. It is the access log. It is the download timestamp. It is the unusual pattern in the last two weeks before a resignation. Courts understand this. That is why Apple may have substantially stronger proof than the press release suggests — or no proof at all.
The cross-border complication. OpenAI trains and deploys globally. If any relevant data touched the EU, GDPR creates a genuine conflict with a US injunctive order. US courts can order parties to produce evidence stored overseas, but foreign data protection law pushes back. OpenAI may slow the clock by pointing to Ireland, Singapore, or Japan. That delay is itself a victory, because an "immediate" injunction that takes months to litigate is no longer immediate. The cross-border dimension could be the difference between a surgical strike and a long siege.
The history that becomes precedent. OpenAI already faces copyright litigation from The New York Times and other authors. A trade secret loss would complete a pattern: a defendant that, in the judiciary's eyes, has repeatedly treated external intellectual property as raw material. The risk is not just the damages in this case. It is the law that the opinion creates. A published ruling on AI training and trade secrets gives every future plaintiff a roadmap. OpenAI therefore has an unusually strong incentive to settle — not because it is guilty, but because a bad precedent is worse than a large settlement. In crypto, this is the same calculus that pushed many protocols to settle with regulators rather than litigate an existential legal question.
The money and the error bar. Apple will have to post a bond for the injunction, and if the injunction is later found to be erroneous, OpenAI can recover damages. The bond requirement is a real check on baseless motions. But for Apple, the bond is pocket change; for OpenAI, the cost of complying with a wrong injunction is a disrupted product launch. The asymmetry is part of the tactical design. Legal filings, like smart contracts, include incentive structures. Apple is calculating that the threat of disruption is worth more than the probability of winning. This is not a case about justice. It is a case about leverage.
The third-party liability web. The exposure does not end with OpenAI as a corporate entity. If a former Apple engineer left with files, that engineer is a natural co-defendant. But the circle widens: investors who funded OpenAI with knowledge of the conduct, cloud providers who stored the training data, and downstream customers who deploy OpenAI models could all become targets in follow-on litigation. In blockchain forensics, I have seen the same multiplication effect — when an exchange collapses, every counterparty becomes a potential defendant. The first hearing is the first page of a very long case file.
The judicial sandbox. In the near term, courts may experiment with something that resembles a judicial sandbox: a limited injunction that allows OpenAI to keep the challenged model in an isolated environment for litigation purposes, but not deploy it commercially. That is a pragmatic compromise, and it is exactly the kind of measure a judge will adopt to balance irreparable harm against the public interest. But a compromise is also a confession: the law has no clean answer. When we reach the point where judges improvise regulatory sandboxes from the bench, the legislature is failing at its job.
Now the uncomfortable part. The bulls on OpenAI are not wrong about everything. California's legal culture is protective of employee mobility, and the inevitable disclosure doctrine is disfavored. Apple's burden is genuinely high. OpenAI has a well-funded defense team and can present a plausible clean-room narrative: internal policies, training, employee declarations. That narrative may be enough to defeat a TRO, even if the underlying merits are murky. The practical reality is that most courts prefer to keep a profitable company running while the case unfolds. An injunction that halts a major AI product will be met with skepticism.
There is also a counter-intuitive outcome worth naming: Apple could win the injunction and lose the war. If a court grants broad injunctive relief, it will likely appoint a monitor or order special discovery into model weights. Apple would then have to disclose the very trade secrets it is trying to protect — to the defendant, to the monitor, and potentially to the public record. The plaintiff's victory becomes a transparency exercise. In crypto, the same dynamic appears when a protocol wins a court order and then has to reveal its own treasury controls during follow-on discovery. The cure is often worse than the disease. Apple's shareholders may be cheering today, but their forensic accountants may not be cheering in eighteen months.
We are about to learn whether trade secret law can survive contact with a machine that remembers everything and forgets nothing. This case is not really about Apple and OpenAI. It is about a legal system that believes secrets are files, while the technology treats secrets as statistical patterns.
If the injunction fails, the message to every company is stark: the moment your proprietary data enters a training set, it stops being yours. If it succeeds, the message to every AI lab is equally stark: you must prove, byte by byte, where every piece of your data came from — and that proof must hold up in court.
Either way, the architecture of trust has a new test case. The courtroom is just another codebase. The judge is the auditor. And the bug, as always, is not in the compiler. It is in the design.