AI Advancements Implicate Adjustments to Trade Secret Protection Strategies

Key Points

• AI-enabled cyberattacks can autonomously find and exploit network vulnerabilities, making involuntary disclosure of trade secrets a more serious and more likely risk.
• Trade secret protection under the Defend Trade Secrets Act depends on the owner having taken reasonable steps to keep the information secret, and courts may weigh cybersecurity practices such as access controls and network segmentation.
• A company whose security measures were adequate when adopted should consider what if any steps should be taken in view of the potential for an autonomous AI intrusion, because the threat landscape has changed.
• Because trade secret protection lasts only as long as secrecy does, the increased risk of disclosure posed by AI intrusions arguably strengthens the case for pursuing patent protection on patent-eligible inventions.

Summary: Advancements in AI have created new challenges, which implicate considered adjustments in trade secret protection strategies. The capabilities afforded by AI have made intrusion and exploitation by bad actors a more serious threat to the protection of trade secrets, and inform a rebalancing of the traditional analysis of deciding whether to pursue patent protection or maintain a new invention as a trade secret. Companies should evaluate their IP protection strategies and security architecture accordingly.

The Growing Risk of Disclosure

Most commentary on AI and trade secrets covers familiar ground: 1) don’t submit confidential information into “open” or publicly available AI platforms; and 2) maintain AI advancements as a trade secret. Both are valid topics. However, neither addresses a more disruptive development: AI deployed as an offensive weapon against trade secret holders, not merely as a leak channel but as an intrusion threat.

The threat to the protection of trade secrets posed by AI intrusion is no longer theoretical. In mid-2026, autonomous AI agents, not directed by any human attacker, escaped contained test environments and compromised production infrastructure at a large technology company, harvesting credentials and proprietary data before anyone recognized the intrusions were AI-driven.[i] Separately, a major AI lab disclosed three incidents in which its models broke out of evaluation sandboxes and gained unauthorized access to real organizations’ systems, with at least one breach undetected for months.[ii] Within a three-week window, four different AI labs and a government security institute disclosed similar containment failures.[iii]

Advanced AI models are now capable of finding and exploiting vulnerabilities in corporate networks autonomously, without any instruction to do so. This threat is far greater when a bad actor decides to deploy these models with the deliberate intention of harvesting trade secrets. Internal AI-use policies and employee training can only mitigate the risk of an external attack, not eliminate it. Thus, AI-enabled cyberattacks present a growing threat of trade secret misappropriation. One consequence tends to support rebalancing the traditional analysis of determining whether to maintain a new invention as a trade secret or pursue patent protection.

The Asymmetrical Threat, in IP Terms

Consider just two data points from recent industry threat reporting. First, the average time to weaponize a software vulnerability has compressed from weeks to single-digit hours once frontier AI models are applied to the task.[iv] Second, AI-enabled intrusions now account for roughly one in four malicious breaches, at an average cost exceeding $6 million per incident, more than $1 million above the non-AI baseline.[v]

What makes this an asymmetrical threat is not just speed but autonomy. Cybersecurity experts are having trouble hardening defenses fast enough to keep pace with the growing threat. Researchers have documented AI systems that independently discovered multiple zero-day vulnerabilities in a major open-source security release, including flaws that had evaded decades of human audits and automated testing.[vi] The attackers no longer need specialized skill or a large team; they only need access to a capable model.

Trade secret law affords protection so long as the owner has taken “reasonable measures to maintain secrecy.” Federal courts evaluating claims under the Defend Trade Secrets Act may examine whether a company’s cybersecurity infrastructure (password policies, access controls, network segmentation) meets that standard.[vii] See, e.g., WWMAP, LLC v. Birth Your Way Midwifery, 711 F. Supp. 3d 1313, 1322 (N.D. Fla. 2024) (“Reasonable measures to keep information secret can include the use of: access control policies or measures . . . compartmentalization of information based on ‘need to know’ . . . cyber security measures, such as encryption . . . [etc.].”) If a company cannot show “reasonable measures to maintain secrecy” then trade secret remedies are unavailable. See, e.g., Inv. Sci., LLC v. Oath Holdings Inc., No. 20 CIV. 8159 (GBD), 2021 WL 3541152 (S.D.N.Y. Aug. 11, 2021) (dismissing a DTSA claim for lack of “reasonable measures” because “[a] business email account with a login and password — a measure deployed by nearly all businesses today — falls short of measures found to be reasonably protective such as a ‘strictly controlled server,’ a password-protected document, or a password-protected folder.”). When the threat model changes fundamentally given the advent of AI cyberattacks, the reasonableness bar moves with it. See Rockwell Graphic Sys., Inc. v. DEV Indus., Inc., 925 F.2d 174, 180 (7th Cir. 1991) (applying a cost-benefit analysis to determine what level of security measures are “reasonable”). The intrusion threat of AI may require the consideration and implementation of improved security measures to meet the evolving “reasonable measures” standard.

Why This Changes the Trade Secret Calculus

The legal analysis of the risks and benefits between trade secrets and patent protection is straightforward. Trade secrets require no public disclosure and no filing, and they can potentially last indefinitely. However, protection survives only as long as secrecy does, until the secret is disclosed or otherwise becomes generally known. Ruckelshaus v. Monsanto Co., 467 U.S. 986, 1002 (1984) (“the extent of the property right therein is defined by the extent to which the owner of the secret protects his interest from disclosure to others.”). On the other hand, patents require public disclosure and carry a limited term. See 35 U.S.C. § 122(b) (publication of patent applications); 35 U.S.C. § 154(a)(2) (20-year utility patent term).

As the probability of involuntary disclosure rises in view of the increased intrusive capabilities of AI, which allow AI to become an offensive threat to confidentiality, the relative value of patent protection increases, even though patents require public disclosure and have a limited term.

This is not to say that trade secrets are of diminished value. It is merely that the election between patent and trade secret protection should be reassessed on a per-asset basis, with the rising threat of involuntary disclosure treated as a material factor in that analysis. When deciding between pursuing patent protection and maintaining an invention as a trade secret, the current cyber landscape tips the balance toward the pursuit of patents.

The time to reassess what “reasonable” security measures are in place in light of the growing risk is now. The scope and magnitude of the threat posed by an autonomous AI intrusion inform the analysis of what protection measures are now deemed “reasonable” under the law, even if they were clearly adequate when implemented.

Three Practical Recommendations

1. Rebalance the analysis of patents versus trade secrets: For patent-eligible innovations, the weight given to patent protection on the deciding scale should be increased. The legal protections afforded to trade secrets for know-how and other confidential information that is not independently patentable remains, but an increased focus on pursuing patent protection may provide a more resilient IP portfolio. This is a strategic portfolio decision that should be revisited as the AI intrusion threat landscape evolves.
2. Harden defenses at AI speed: A major intelligence alliance warned earlier this year that AI is reshaping offensive cyber capabilities on a timeline of months, not years.[viii] Periodic patch cycles designed around quarterly reviews cannot match an adversary that weaponizes a vulnerability in hours. Companies should consider adopting continuous, automated vulnerability detection and remediation.
3. Tier and isolate the most critical information: The mid-2026 autonomous breaches demonstrated a consistent pattern: once agents gained an initial foothold, they moved laterally through interconnected cloud, container, and VPN infrastructure, harvesting credentials at each step.[ix] It may be appropriate to place critical trade secrets behind additional layers, including air-gapped or isolated networks, separate from the general corporate environment. This is not just good security practice; it directly supports compliance with the “reasonable measures” standard.[x]

Bottom Line

In 2026 alone, multiple AI systems have autonomously breached corporate infrastructure without human direction, and major threat reports confirm that AI-enabled attacks are accelerating.[xi] Companies should consider auditing their IP portfolios now to identify which crown-jewel trade secrets may be single points of failure and revisit the patent-versus-trade secret election. The companies that adapt their IP strategy to the current threat environment, rather than the one they planned for, will be better positioned to protect their most valuable innovations. If your organization has not recently assessed whether its trade secret protections and IP filing strategy reflect this shift, now is the time to start that conversation.

If you have questions about how these developments affect your trade secret and patent strategy, please contact Charles E. Phipps, Grant D. Marshall, or your Troutman Pepper Locke attorney.

[i] Cloud Sec. All. AI Safety Initiative, Hugging Face Breach: Anatomy of a Rogue AI Agent Swarm, Cloud Sec. All. (Sept. 4, 2026), https://labs.cloudsecurityalliance.org/research/csa-research-note-autonomous-ai-agent-swarm-hugging-face-bre/.

[ii] Investigating Three Real-World Incidents in Our Cybersecurity Evaluations, Anthropic (July 30, 2026), https://www.anthropic.com/news/investigating-incidents-cybersecurity-evals.

[iii] Kinza Yasar, When AI Agents Go Rogue: What Enterprise Leaders Need to Know, TechTarget (Aug. 27, 2026), https://www.techtarget.com/ai/news/366649796/When-AI-agents-go-rogue-What-enterprise-leaders-need-to-know.

[iv] Sascha Brodsky, IBM Expands AI Security Push as Cyberattacks Accelerate, IBM: Think (May 21, 2026), https://www.ibm.com/think/news/ibm-expands-ai-security-cyberattacks-accelerate.

[v] Nadia Dubois, AI Weaponizes Bugs in 48 Hours, Breaches Hit $6.04M, Tech Insider (Sept. 10, 2026), https://tech-insider.org/ai-cyberattacks-48-hour-exploit-crowdstrike-2026.

[vi] Linus Folkerts et al., Measuring AI Agents’ Progress on Multi-Step Cyber Attack Scenarios, AI Sec. Inst. (Mar. 16, 2026), https://arxiv.org/pdf/2603.11214v2.

[vii] Raj Sachdev, “Reasonable [Cybersecurity] Measures” for Digital Trade Secrets: Lessons from Marketing, 65 IDEA 39, 58 (2025).

[viii] Dubois, supra note v.

[ix] Cloud Sec. All. AI Safety Initiative, supra note i.

[x] Sachdev, supra note vii.

[xi] Brodsky, supra note iv.