Investigating IP Theft in the Gen AI Era—Webinar

Rogue employees leveraging generative AI tools to extract trade secrets create severe exfiltration risks that traditional forensic investigations fail to catch.

In a recent webinar with Today’s General Counsel, iDiscovery Solutions Managing Director of Digital Forensics and eDiscovery Mark Clews examined how employee departures and IP theft are changing in the generative AI era. The session, “Employees Going Rogue: IP Theft in the Gen AI Era,” outlined why relying solely on traditional USB or cloud exfiltration checks leaves dangerous blind spots, and how legal and IT teams can reconstruct multi-layered evidentiary timelines from client-side remnants, vendor exports, and corporate unified audit logs.

Clews highlighted the fundamental shift in how trade secrets leave an enterprise.

“The difference with GenAI now, it’s not the files itself that are moving out of the environment, it’s the knowledge,” he said.

Key takeaways from the session:

• Recognize the limits of traditional forensic checks: Traditional indicators like hash matching or USB activity fail to catch generative AI exfiltration because knowledge is composed rather than copied, meaning no file ever has to move.
• Reconstruct deleted chats across multiple data layers: Server-side vendor exports only display what currently exists, making local browser history, client-side caches, and desktop app remnants critical for recovering deleted prompts.
• Leverage corporate API logs to prove access: Even if a user deletes their chat history, connector integrations—such as Microsoft Graph API calls—leave permanent records in M365 Unified Audit Logs showing which files were accessed.
• Update hold policies and image endpoints immediately: Organizations must add AI accounts and vendor logs to litigation hold templates and image departing employee devices within 48 hours to preserve local cache evidence before it is lost.

Balancing the rapid adoption of AI tools with effective risk mitigation requires updating your departure and investigative protocols. Watch the full recording to learn how your team can surface hidden AI evidence and protect institutional IP.