Apple v. OpenAI, a $5 Million Frontier Model, and the Spy in Your Repo

THE NUMBER: $5 million a month. That’s the retail price of a frontier model. Anthropic told the Senate that Alibaba employees allegedly farmed 28.8 million Claude outputs through roughly 25,000 fraudulent accounts this spring. Run the napkin math: 25,000 accounts at $200 a month is about $5 million. Frontier training runs cost a billion dollars and up. Somebody may have closed most of that gap for the price of a mid-size law firm’s office lease, paid monthly, no CapEx. Hold that number, because every story today is the same story at a different price point.

Berlin, November 1989. In Atomic Blonde (one of the great needle-drop soundtracks ever cut: Bowie’s “Cat People,” “99 Luftballons,” “Voices Carry”), the most valuable asset in the Cold War’s final week isn’t a weapon. It’s a Stasi officer codenamed Spyglass, played by Eddie Marsan, who has memorized the List: every agent, every alias, every double, including Satchel, the mole who’s been selling both sides the whole time. The microfilm is a McGuffin. The database is the man. Every service in Berlin is willing to kill to move him or stop him, because once the knowledge lives in a head, the checkpoint is theater. And days after the shooting stops, the Wall comes down anyway.

That was AI this week. Apple filed suit Friday in the Northern District of California accusing OpenAI of systematically stealing hardware trade secrets through the 400+ former Apple employees now on its payroll. The same week, we got the receipts on China allegedly distilling Claude through 25,000 fake accounts, an arrangement that compressed an 18-month capability gap to 6-9 months for five million bucks a month. And a security researcher with a packet sniffer caught xAI’s Grok Build CLI uploading entire git repositories (full history, unredacted .env credentials) to a Google Cloud bucket, on a tool marketed as local-first, with a privacy toggle that turned out to govern nothing. xAI fixed it silently and said nothing.

Three leaks. Three vectors. People, APIs, tooling. And a fourth one hiding in plain sight: Satya Nadella spent the weekend warning everyone about “intelligence exhaust,” the proprietary judgment you leak to your AI vendor every time you use the product. He’s right. He’s also selling the antidote, which is how you know the diagnosis is real. Everybody in Berlin worked at least two sides.

Here’s the thread. For an LLM to work for you, you have to feed it real information. Your actual pipeline, your actual code, your actual decisions. Which means it trains on your human judgment, and your judgment is the last advantage you have. We wrote on July 6 that the market had repriced judgment as AI’s scarcest asset. This week the market showed you the theft report. Everything you’re about to read is somebody stealing judgment, at prices ranging from $200 a month to a federal lawsuit.

🔒 Apple’s Mole Hunt Is Aimed at the IPO

Apple sued OpenAI on Friday in federal court, and the complaint reads like a counterintelligence file. Named defendants include Tang Tan, Apple’s hardware lifer of 24 years and now OpenAI’s chief hardware officer, and engineer Chang Liu, who allegedly exploited an authentication bug to pull confidential files after he’d already left, then texted a colleague that the access was “so funny.” The complaint alleges candidates were coached to bring “actual parts” (physical Apple components) to OpenAI interviews, that recruiters used Apple’s internal project code names, and that a proprietary metal finishing technique made the trip too. Apple’s language: “the tip of the iceberg,” a hardware program “rotten to its core.”

Let’s be honest about the base rate. People are the ultimate leakers, and this stuff happens constantly. Engineers move, know-how moves with them, companies exchange stern letters, and the lawyers settle it quietly over 18 months. Apple itself sent OpenAI a warning letter in February and got silence. So why does a February grievance become a July lawsuit with a jury demand and a request to force a redesign of OpenAI’s unreleased device?

Look at the calendar. OpenAI confidentially filed for its IPO, its Jony Ive device is expected in 2027, and the suit landed the Friday after OpenAI’s biggest launch week of the year (GPT-5.6, ChatGPT Work). A jury trial means discovery, and discovery means OpenAI’s hardware program gets deposed under oath during the exact window it’s trying to price an offering. Apple doesn’t need to win. It needs to make every prospective IPO investor read a risk-factors section that mentions “misappropriated trade secrets.” The weekend sideshow (Musk calling Altman “Scam Altman,” Altman swinging back at SpaceX’s $75B raise) is noise. The filing date is signal.

Now notice the name that isn’t in the complaint: Jony Ive. That’s the tell about what Apple actually fears. Ive’s been gone since 2019, and whatever roadmaps he remembers expired years ago. He doesn’t need to say a word. He needs to ship the appliance that makes you stop reaching for an iPhone. Run the honest inventory on what that phone still does for you: the calls stopped mattering a while ago. It’s iMessage, the blue-bubble Bloomberg terminal that American life actually runs on, and, more every quarter, the AI. Play the deletion game on your own home screen: Facebook, TikTok, Instagram, Claude. Claude goes last. Apple ships the glass and none of the intelligence, and no jury can fix that. Which is why the suit reads less like recovery and more like a stall: slow the clock on the 400 people who know where the tolerances are, because the device they’re building has one pitch, and the pitch is that the intelligence, not the glass, is the product.

The bottom line for executives: Your IP strategy has a people-shaped hole in it, and so does your competitor’s. If a rival’s team suddenly staffs up in your specialty, assume your know-how traveled and act on the timeline Apple didn’t: months, not quarters. And if you’re the one hiring, the conversation to have with counsel is simple: what did these people touch, and what’s our story when the letter arrives?

🇨🇳 The $200-a-Month Heist

Distillation isn’t new. It’s been happening since the first GPT wrapper shipped, and it will keep happening as long as model outputs are purchasable. What’s new is that we finally got numbers. Anthropic’s June 24 letter to the Senate Banking Committee alleges 28.8 million Claude outputs farmed through ~25,000 fraudulent accounts in six weeks. A source close to the company says the practice compresses China’s frontier gap from 18+ months to 6-9. Six of the ten most-used AI models in the world are now Chinese.

Do the arithmetic we did up top: $5 million a month. That’s not a heist crew tunneling into a vault. That’s paying retail, at scale, with someone else’s ID. The vault is the product. Every output a frontier model sells is a compressed sample of the judgment that trained it, and the export control that stops a person at the border does nothing to an API response.

And here’s the part Washington doesn’t want to sit with: the demand side isn’t waiting for the verdict. DoorDash, Airbnb, and Siemens are already routing work to cheaper Chinese models, DeepSeek and Z.ai have overtaken Claude and ChatGPT usage on OpenRouter, and Aidan Gomez’s point about the June Mythos export ban still stands: yanking a US model off the market taught every foreign buyer that dependence on American AI is itself a risk. Shelly Palmer’s frame is the one to remember: America is building the best AI. China is building the default.

Connect the dots: the alleged theft and the voluntary defection are the same supply chain. Judgment goes in at $200 a month, ships out as a model that’s 90% as good at a tenth of the price, and your procurement team buys it back because the CFO likes the invoice.

Why this matters: If your differentiation is a workflow, a dataset, or a decision process you feed into a frontier model, price in that some fraction of it is being resold. The question for your team isn’t “do we trust the vendor,” it’s “which of our inputs would hurt if they came back out as somebody’s product?” Segment accordingly.

🦞 The Wire in Your Toolchain

The Grok Build story deserves more attention than it’s getting, because it’s the leak vector nobody’s lawyer is watching. A researcher ran a packet capture on xAI’s coding CLI and found that a 12 GB test repo generated 192 KB of legitimate model traffic and roughly 5.1 GB of uploads to a bucket named grok-code-session-traces. Full git history. Unredacted credentials. The “Improve the model” opt-out? It governed training consent, not collection. After disclosure, xAI flipped a server-side flag, shipped a changelog that mentioned nothing, and posted “We care deeply about your privacy.” One researcher, one machine, so hold it loosely. But the capture gist is public, and nobody’s disputed it.

Now zoom out, because the interesting question isn’t whether this was a bug. Since SpaceX bought Cursor, Elon owns the most-traveled coding harness in the industry, plus a model trained on what flows through it. That’s why Grok 4.5 sits at #1 on the coding-agent leaderboard at a fraction of Anthropic’s price, and it’s why the best coding platform of 2027 probably comes out of that stack: he sees more real engineering judgment per day than anyone. The flywheel is real. But the flywheel and the leak are the same pipe. A bucket named session-traces is the business model showing through the drywall. The whole bet rests on enterprises tolerating the exhale, and a silent fix with no advisory is exactly how you lose that tolerance.

Our position: this is the trade of the year in dev tools. The data advantage compounds daily, and the trust liability compounds with it. One more incident like this and “bring your own harness” becomes a board-level mandate.

Here’s what to do: Treat every AI tool with repo or file access like a privileged service account, because that’s what it is. Have your security team packet-capture your top three AI tools this quarter. Not the vendor’s documentation. The actual traffic. If the traces don’t match the terms, you just learned something worth more than the tool.

💲 Everybody’s Preaching, Everybody’s Long Their Own Book

Nadella’s weekend “intelligence exhaust” sermon was genuinely epic, and genuinely correct, and you should notice who’s giving it. Microsoft (NASDAQ: MSFT) holds the largest single investment in OpenAI, the frontier lab that just collected an Apple lawsuit, a safety-chief departure, and an IPO cloud in the same news cycle. In our view it’s the worst position on the frontier board right now, and the credit market is starting to agree: S&P just cut Oracle’s rating and named OpenAI exposure as a reason. When your flagship partner becomes a bond desk’s risk factor, you stop selling capability and start selling trust. Which is exactly what “keep your data inside our enterprise boundary” is.

And be precise about what Microsoft actually holds. The OpenAI stake is magnificent, and it’s yesterday’s news. It exists. The future value, and the liquidity to realize it, don’t exist yet, and Friday’s lawsuit is parked directly on the exit ramp. A paper gain you can’t sell isn’t a win. It’s a position.

The tell: in the same week Microsoft made GPT-5.6 the preferred Copilot model, it started routing Excel and Outlook prompts to its own cheaper internal models. Preaching data hygiene while quietly diversifying away from your own partner isn’t hypocrisy. It’s a hedge, and hedges are information.

Translation: when capability converges every six weeks, trust is the only durable differentiator, so everyone with a distribution channel is suddenly a trust vendor. Karp does it, Nadella does it, Anthropic’s whole brand does it. Fine. Just read every sermon the way you’d read a sell-side note: the advice can be right and the book-talking can be real at the same time.

What This Means For You

Every vector in today’s issue points the same direction: the scarce asset isn’t the model, it’s the judgment you feed it, and the AI economy is a machine for collecting judgment at every seam.

Audit your intelligence exhaust before someone else monetizes it. Inventory which vendors see your decisions, your corrections, your code, and your deal flow, and decide which of those channels you’re being paid enough to leave open.

Treat people as your largest data pipe. The 400 engineers in Apple’s complaint moved more proprietary judgment than any API ever will, so your retention plan and your IP plan are the same document now.

Assume the tools are wearing wires until traffic proves otherwise. Verification beats terms of service; a quarterly packet capture costs nothing next to a session-traces bucket full of your credentials.

Buy trust like the asset it just became. Vendors who survive an audit, publish advisories, and route around their own conflicts are worth a premium over vendors who fix things silently, because the next leak is a when.

The labs will keep suing each other, and the sermons will keep coming from people talking their own book. You can’t stop the leaking. You can decide what’s worth leaking, to whom, and at what price. The firms that price their judgment survive this era. The ones that give it away at retail become somebody’s training run.

Three Questions We Think You Should Be Asking Yourself

• If your three best people left tomorrow, what actually walks out the door, and what did your vendors already collect? Apple can name its stolen secrets in a federal complaint. Most mid-size companies couldn’t write that paragraph. If you can’t inventory your judgment, you can’t protect it or price it.
• Have you ever verified what your AI tools transmit, or just read what the vendor says they transmit? One researcher with mitmproxy found a 5 GB gap between the two. Your security team can run the same test in an afternoon. The uncomfortable part isn’t the test. It’s what you do if the traces don’t match the terms.
• Are you selling your judgment for $200 a month? Every prompt with real context in it is a micro-license of your expertise to a counterparty whose business model is compressing expertise into weights. Sometimes that trade is worth it. It’s worth deciding on purpose instead of by default.

---

“Trust no one.”
— Atomic Blonde‘s operating manual. As of this week, yours too: the List is real, and your name is on somebody’s.

---

— Harry and Anthony

Signal/Noise by CO/AI is published most weeknights from New Canaan, Connecticut. The point is to make you the smartest person in the room without taking more than fifteen minutes of your morning. If we did, forward it to one person. If we didn’t, hit reply and tell us why.

---

Sources

• Apple sues OpenAI over alleged trade secret theft — TechCrunch, Jul 10, 2026
• Apple sues OpenAI alleging trade secret theft, says scheme was ‘at every level’ — CNBC, Jul 10, 2026 · Axios, Jul 10, 2026
• How China is ripping off cutting-edge AI from Anthropic, OpenAI — and threatening US national security — NY Post, Jul 13, 2026 (Anthropic’s Jun 24 Senate Banking letter: 28.8M outputs, ~25,000 accounts, Apr 22–Jun 5)
• US companies are realizing Chinese AI models are way cheaper — Futurism, Jul 13, 2026, off FT reporting (DoorDash, Airbnb, Siemens; OpenRouter usage flip)
• xAI’s Grok Build CLI uploads entire Git repositories to a Google Cloud bucket — International Cyber Digest, Jul 13, 2026 (fix confirmed in v0.2.98 changelog, Jul 12) · @SpaceXAI privacy statement
• America is Building the Best AI. China is Building the Default. — Shelly Palmer, Jul 12, 2026
• Satya Nadella’s “Reverse Information Paradox” / “intelligence exhaust” X post (this weekend), Musk–Altman exchange (CNBC, Jul 12), and S&P’s Oracle downgrade citing OpenAI — via AI Breakfast and Techpresso roundups, Jul 13, 2026
• CO/AI prior issues referenced: The Turk Retires (Jul 6), Ghost in the Machine (Jul 9), Man Behind The Curtain (Jul 13)