The OpenAI Files: What a Last-Day Upload Teaches Us About Insider Exfiltration

The OpenAI Files: What a Last-Day Upload Teaches Us About InsiderExfiltration

On his last day at OpenAI, an engineer allegedly opened his personal accounts and sent himself more than a hundred files describing a device the world has not seen. Nobody noticed. Four months later, the company found out, and only because lawyers in a separate lawsuit were already digging through his activity.

That is the story OpenAI put in front of a federal court this week. Whether it holds up for the court is one issue. The much bigger issue is that this incident shows how companies can lose their most valuable data without a breach, without malware, and without anyone outside the building lifting a finger.

If it can happen to the most watched AI company on earth, it is happening somewhere else right now.

What happened

The dispute started with Apple, not OpenAI. The sequence matters, because the alleged theft sat undetected through most of it.

• Late 2025: An Apple employee leaves for OpenAI, where he works for about six months.
• June 2, 2026: His last day at OpenAI. He allegedly sends more than 100 confidential files about an unreleased OpenAI device to his personal accounts.
• June 2026: He returns to Apple.
• July 2026: Apple sues OpenAI and two former Apple employees in federal court in San Jose, alleging theft of “dozens of Apple's confidential hardware-related files” and poaching of hundreds of staff.
• Summer 2026: During a “recent and ongoing forensic investigation” tied to that suit, OpenAI says it finds the June 2 transfer.
• October 2026: Apple launches the Apple Home line of smart home accessories.
• October 14, 2026: OpenAI files its allegation, claiming the documents aided Apple's “new push into AI-enabled products.”

Why this pattern should look familiar

Apple and OpenAI are eye-catching names, but taking those away, what remains in the filings is one of the most common data loss stories:

An employee with legitimate access to sensitive material decides to leave.

In their final days, files move from company systems to somewhere the company cannot see: a personal email account, a personal cloud drive, a USB stick, a personal AI assistant.

For most companies, this remains undetected, because no one was breaking in, or exploiting anything. The access was granted when the employee still had legitimate intent with the company.

In this case, June 2 was this employee’s last day. This is usually the exact window when the incentive to steal data and documents is highest for a departing employee, and attention is lowest to the account.

The content is another interesting factor in this case. The alleged haul was not customer PII or credit card numbers, the categories most legacy DLP programs are tuned for. It was engineering drawings, manufacturing data, supplier names, and project plans. Unstructured, proprietary, and invisible to any rules-based technology that only knows what a Social Security number looks like.

And the destination is the third. Personal accounts are the simplest exfiltration path there is. They need no technical skill, leave no malware signature, and look identical to the thousand harmless things employees do in a browser every day. A security program that cannot tell the difference between “forwarded a lunch invite to Gmail” and “forwarded the supplier list to Gmail” has to either block everything or allow everything. Most allow everything.

What Legacy DLP cannot see

We do not know what tooling OpenAI runs, and this is not a comment on it. What we do know is why this exact scenario slips past most legacy DLP that companies still have installed.

• It fires too late. An analyst review is delayed, usually until the employee and the files are already gone.
• It does not understand the content. Regex and keyword rules catch structured identifiers. They do not know that a CAD rendering is a CAD rendering, that a spreadsheet of vendor contacts is a supplier list, or that a slide deck describes an unannounced product.
• It does not know where the file came from. A PDF attached to a personal Gmail draft could be a restaurant menu or the manufacturing plan for a device nobody has seen. Legacy tools inspect the file in isolation. They have no record that it was downloaded from a restricted engineering drive twenty minutes earlier.
• It treats every day the same. Policy is static. A person on their last day with a resignation on file gets the same thresholds as a new hire in onboarding.

Together, they create the damning result like that seen in the legal filing: a company that discovers the loss months afterward and takes the only action still available, which is to sue.

What to check this week

You do not need a hardware division or a lawsuit to have this problem. Any company with a roadmap, a customer list, or source code has employees who will eventually leave with access to it.

A few questions to ask of your current DLP provider:

• Can you block, in real time, an upload of a restricted file to a personal email or cloud account from a managed laptop? If the answer is “we would see it in the logs,” that is a no.
• Do your detectors recognize your proprietary material, or only regulated identifiers? If a design file and a lunch menu look the same to your DLP, nothing is stopping the design file from leaving.
• Does your policy change when someone gives notice? Departure is the single most predictable risk event in the employee lifecycle, and most programs do nothing differently.
• How long between an exfiltration event and a human seeing it? Measure it. If the number is in days, the response is forensic, not preventive.

Nightfall stops data from leaving across browsers, endpoints, email, SaaS, and AI tools with one policy and one incident queue. Book a demo here.

‍