We own everything the AI writes for us. It’s in the contract, right?
Depends on which model — and plan — you’re using. Let’s take two people who open Claude on a Monday morning. They’re using the same model. But one of them is paying for a personal Pro account, and the other is on an enterprise account their company set up.
They put in the same prompt, and they get the same answer back.
They might be in the same chat window, but legally, they’re in completely different universes.
Last August, Anthropic introduced a new setting to the consumer version of Claude that lets the company use your chats and coding sessions to train their models. Of course, the default is set to “on.” And if you keep it on, anything you type can stay in the training pipeline for up to five years.
The other side of the company — the one that sells Claude to companies — runs on a different contract. By default, nothing you send is used to train anything. They even sweetened the deal: If the AI’s output gets you sued for infringing on somebody’s intellectual property, Anthropic will defend you for authorized, paid use, with the usual carve-outs for things you did yourself.
Of course, these are words, not architecture. “No training” is a promise that the company won’t train on your inputs and outputs. But your inputs and outputs still have to traverse their servers. So you have to trust the policy.
But a closer read of the contract raises a much bigger question: Does anyone really own what the AI writes? And therefore, can it be protected by law? Anthropic’s contract assigns you all of its rights in the output — “if any.” Those two words are doing a lot of work, because under US law, copyright currently requires a human author. Code or words written purely by a machine get no new copyright. (In fact, Google’s developer terms don’t even bother to assign anything. They say Google won’t claim ownership over what you generate, and they reserve the right to generate the same thing for someone else.)
So, who knows about the stuff coming out of the models. But what about what went in?
Taking the Confidence out of Confidential
American law protects trade secrets — the formula, the code, the process that’s valuable precisely because nobody else can see it. But the protection has a condition: It requires that you’ve taken “reasonable measures” to keep the thing a secret.
So…if your developers spent the last year pasting the crown jewels into a consumer chatbot, did you take reasonable measures…?
Until recently, no one could tell you. But this year, two federal courts finally gave us answers. In January, a judge in California threw out a trade-secret claim in part because the plaintiff had built her “secret” inside ChatGPT, basically handing it to OpenAI along the way. And in February, a New York judge held that the documents a defendant had generated with Claude weren’t confidential at all, because Anthropic’s privacy policy allowed the company to use them. That’s just two trial courts — not the last word — but listen to what they’re saying.
This isn’t new, either. In the spring of 2023, Samsung engineers put proprietary code and data into ChatGPT to help fix bugs three times in less than a month. The engineers weren’t trying to sell trade secrets, nor were they being careless. Like anyone using AI, they were simply trying to do their jobs faster. And that’s the shape of the risk. It’s not a hacker that we have to worry about. It’s not a breach. It’s just a company using an expensed subscription account in the wrong way.
Is Open the New Closed?
Do open models help with any of this? Well, an open-weights model is a different beast. You run it on your own machine, and your prompts go nowhere. Not “nowhere we promised not to look.” Actually nowhere.
That seems good, but it does come with caveats. There’s no company to stand behind you in court. And no one is on the hook when the output plagiarizes something else. It gets more complicated when you put that open model on somebody’s cloud, because now the open weights are on a hosted service. And you have to read that company’s contract, too.
And the obvious, but worth saying: If you open-source what you build, you’ve chosen to give up the secret.
What do you do? My advice:
Know which door you’re using. Open your AI settings today and understand what plan you’re on, whether the training switch is on, and what the data-retention policy is.
Decide what never leaves. The cheapest way to protect a secret is to not send it in the first place!
Run the model where the secret lives. If your secret cannot leave the building, then run the model in the building. That way you know where the data flowed.
If you invest in software companies, ask which tier the developers were when they wrote it. A closed model promises not to tell. An open model on your own laptop can’t.
The deed to machine-written code may be blank no matter whose machine wrote it. What’s real is who holds the model, the data, the secrets — and the proof of what the humans made.