Apple came out swinging, suing OpenAI and accusing former employees of stealing confidential hardware secrets.

But then came the twist: the real insider may have been Apple’s own iCloud.

According to court filings, a former Apple employee was allegedly able to access confidential company files even after leaving the company, raising questions about how Apple’s own systems handled access permissions and offboarding.

In other words, while Apple accused OpenAI of poaching employees and obtaining its hardware secrets, the case also exposed a much more embarrassing problem:

Apple’s own cloud infrastructure may have left the door open.

Last month, Apple filed a 41-page complaint in the U.S. District Court for the Northern District of California, suing OpenAI, its acquired hardware company io Products, and two former Apple employees.

One of the defendants is Chang Liu, a senior systems electrical engineer who spent eight years at Apple working on iPhone hardware development. He left Apple in January this year to join OpenAI.

The other is Tang Tan, Apple’s former vice president of product design, who is now OpenAI’s chief hardware officer.

Apple’s allegations are serious.

According to the complaint, after leaving Apple, Chang Liu allegedly refused to return his company computer. Apple also discovered that he had found a previously unknown authentication vulnerability that allowed him to continue accessing Apple’s cloud storage.

OpenAI was even accused of encouraging Apple employees to bypass offboarding security checks, allegedly asking candidates to bring Apple product batteries, logic boards, and prototypes with them.

Apple’s complaint used unusually forceful language, alleging that “from members of the engineering team to the chief hardware officer,” OpenAI was systematically taking Apple’s trade secrets and confidential information at every level.

Over the past several years, OpenAI has reportedly hired more than 400 former Apple employees, spanning product design, displays, antennas, supply-chain management, hardware procurement, and other departments — effectively assembling much of the talent needed to build an end-to-end hardware operation.

But then came an unexpected twist.

According to a recent report by The Information, the vulnerability that allowed Apple’s confidential information to remain accessible may have been created by Apple’s own systems and policies.

Several former Apple employees told the publication that they never actively searched for or copied old company files after leaving. Yet confidential Apple documents remained in their personal iCloud accounts, with some continuing to sync even after their departure.

In some cases, former employees reportedly received notifications from iCloud telling them that documents had been updated years after they had left Apple.

The problem appears to stem from the way Apple manages iCloud internally.

Apple has long encouraged its employees to use its own products. Internal collaboration relies heavily on Pages, Keynote, iMessage, and iCloud, which forms the backbone of that ecosystem.

When new employees join, Apple provides 2TB of iCloud storage and encourages them to merge it with their existing personal iCloud plans.

Because an iPhone can use only one primary Apple ID to unlock the full range of iCloud features, many Apple employees simply use their personal Apple IDs for work.

That means personal accounts and sensitive corporate information can end up living side by side.

Apple did have safeguards in place.

The company introduced a company-managed Apple Work folder specifically for work-related files. In theory, that folder disappears when an employee leaves.

But shared files do not automatically end up in Apple Work.

A Pages document or presentation saved somewhere else can remain in the employee’s personal iCloud, sitting alongside photos, bills, and other personal files.

The problem was compounded by differences in offboarding procedures. Senior executives reportedly receive dedicated assistance when their devices are inspected after departure, while reviews for ordinary employees can be much less rigorous.

As a result, sensitive files could remain outside Apple’s corporate systems even after employees left the company.

Apple has responded that the conduct described in its lawsuit was unrelated to files shared or stored through iCloud, and said it would not sue former employees who inadvertently retained internal documents in their personal iCloud accounts.

But that response itself appears to acknowledge something significant:

Apple’s confidential documents did, in fact, remain in some former employees’ personal iCloud accounts.

OpenAI, meanwhile, has not simply sat back and watched the case unfold.

On August 3, OpenAI published a lengthy response on its website, rebutting Apple’s allegations point by point and releasing multiple emails and iMessage exchanges.

According to those records, Chang Liu continued accessing Apple systems after leaving the company because Apple employees still at the company had contacted him for technical assistance.

OpenAI called Apple’s lawsuit “careless” and “oddly personal,” arguing that the allegations were inconsistent with Apple’s reputation.

Apple subsequently asked the court for a preliminary injunction seeking to prevent OpenAI and the former employees involved from accessing any Apple confidential information.

OpenAI responded that it does not have and does not want to possess any Apple trade secrets.

At a deeper level, the lawsuit is really about the battle for the next major AI hardware platform.

OpenAI is developing its own devices, hoping to create new hardware through which users can interact with AI assistants.

For Apple, the potential financial damages may not be the most important issue.

Disrupting OpenAI’s hardware ambitions could be far more valuable.

But in trying to expose OpenAI’s alleged theft of trade secrets, Apple may have inadvertently exposed something of its own:

a weakness in how it manages corporate data after employees leave.

What began as a lawsuit over alleged intellectual-property theft has turned into a much broader question about offboarding, cloud security, and who really controls corporate data once it leaves the company’s walls.