Trade secret protection has entered a new frontier. As AI agents proliferate across enterprise environments, companies face an underestimated threat: employees wielding powerful language models on personal devices, uploading proprietary information to cloud services, or accidentally exposing confidential data through casual AI tool usage.
Seth Kugler, a partner at Grellas Shah LLP, a law firm specializing in employment and technology issues, issued a direct warning to executives in a guest commentary for Crunchbase News. The risk isn't hypothetical. AI agents lower friction barriers to information access. An employee can prompt ChatGPT, Claude, or a custom enterprise model with questions about internal processes, competitive strategies, or product roadmaps. That same employee might paste code snippets, financial projections, or customer lists into generative AI tools running on unmanaged personal devices or SaaS platforms with unclear data retention policies.
The exposure compounds in practice. Unlike traditional data breaches where IT controls the perimeter, AI agents operate in gray zones. A salesperson uses Copilot on a personal laptop. An engineer feeds proprietary algorithms into an open-source LLM. A finance analyst uploads spreadsheets to a free tier AI tool to automate analysis. None triggers obvious red flags. All represent leakage vectors.
Kugler's recommendations center on structural change, not wishful thinking. First, adopt strict AI policies that explicitly govern which tools employees can use, what data categories are off-limits, and consequences for violations. Second, restrict data access on unmanaged devices through Mobile Device Management (MDM) or Zero Trust architecture. If it's not a company device or a device enrolled in security protocols, it shouldn't connect to sensitive systems. Third, update confidentiality agreements and employment contracts to address AI specifically. Legacy NDAs written before generative AI existed contain gaps. They don't address uploading data to third-party AI services or using AI agents to summarize confidential information.
Fourth, move fast when misuse surfaces. Discovery of an employee feeding trade secrets to an AI tool demands immediate investigation, legal documentation, and potentially aggressive remediation including injunctions or termination.
The timing matters. Enterprise AI adoption accelerates daily. Companies racing to deploy AI agents for productivity gains often skip security architecture. They assume IT controls data flow the way it did five years ago. It doesn't. Employees have agency. They have phones. They have accounts on services the company didn't authorize.
Grellas Shah has built a practice around exactly this tension. Employment law meets technology risk. The firm counsels clients on how to enforce policies without suffocating innovation or creating legal exposure for overly invasive monitoring.
For startups and scale-ups, the risk cuts deeper. Smaller companies rely on trade secrets and proprietary methods as competitive moats. They can't always compete on brand or scale. A single employee departure with data intact, or a contractor who uploaded source code to an AI training service, can erode years of development advantage.
The conversation around AI governance has focused heavily on bias, transparency, and regulatory compliance. Trade secret protection in the AI era represents a parallel but distinct challenge. It sits at the intersection of data security, employment law, and business survival. Companies that treat it as a technical IT checkbox will learn expensive lessons. Those that integrate it into policy, legal agreements, and operational oversight gain a real advantage.