WebKit-based browsers on iOS and macOS can be configured to route all web traffic through proxy servers, which is how Tor browsers on iOS and our own Psylo work. We found three WebKit features — DNS prefetching, WebAuthn Related Origin Requests, and WebTransport — that bypass the configured proxy and send traffic directly from the device, which exposes the user’s real network. The same leaks also affect Apple’s iCloud Private Relay.
[…]
It must be noted that VPNs are not affected, since they tunnel the device’s entire network traffic at the system level.
[…]
We’ve addressed all three leaks in Psylo 1.3.1[…] Passkeys and WebTransport have legitimate uses, so both can be re-enabled at any time through per-silo toggles. This keeps Psylo leak-free out of the box, while users who need one of these features on a given site can opt in explicitly, with a clear understanding of the trade-off.
In an ideal world, we’d report the issues to Apple, they acknowledge the issue, and ship a fix in a timely manner. Unfortunately, our past experience with Apple tells us that reporting this issue would involve months of delays, inconsistent communication, and in some cases, denying the issue’s impact entirely.
We weren’t willing to wait months, or upwards of a year, sitting on bugs that undermine the core privacy guarantees of Psylo and iOS Tor browsers while saying or doing nothing.
[…]
Should we knowingly leave our users exposed while waiting for a system-level fix? We didn’t think that was acceptable or fair to our users. Or should we quietly ship our own mitigations without telling anyone? We didn’t think that was acceptable either. Security fixes deserve transparency, especially when they involve tradeoffs.
Soon after we published the blog, we sent a link to the blog and demo website to Apple in a security report to make them aware of it. Now the report is already in the status “We’re planning to address the issue you reported.” and a fix is planned for Fall 2026 🤯🤯🤯
On Thursday, a US District Court in Oregon ordered the US government to restart the process of approving wind projects. All new wind development in the US has been on hold since August 2025, when the Department of Defense (DoD) stopped participating in a process that allows it to compel developers to alter projects in order to limit their interference with radar equipment. The court ruled, however, that the DoD's national security claims did not allow it to opt out of a process that is legally mandated.
The Trump administration has made many attempts to block wind development, both offshore and land based. Its attempts to stop offshore wind included the same approach at issue in this case: Claim that drone developments mean that radar interference by wind turbines creates a national security risk. The courts were not sympathetic to this claim, including in cases where judges examined a classified report that the DoD was using to justify blocking offshore wind construction. As a result, the administration has turned to paying companies not to pursue wind development.
In parallel, the government was pursuing a similar approach for onshore wind. Here, a law lays out a process for the DoD to evaluate any problems posed by wind turbines and negotiate changes to planned wind farms with the developers. As laid out in the new decision, the government simply stopped participating in this process in August 2025, first by refusing to sign off on previously negotiated agreements, and later by refusing to draft agreements entirely. Eventually, it simply refused to participate in negotiations at all. This has brought a halt to all wind development in the US.
On Thursday, a US District Court in Oregon ordered the US government to restart the process of approving wind projects. All new wind development in the US has been on hold since August 2025, when the Department of Defense (DoD) stopped participating in a process that allows it to compel developers to alter projects in order to limit their interference with radar equipment. The court ruled, however, that the DoD's national security claims did not allow it to opt out of a process that is legally mandated.
The Trump administration has made many attempts to block wind development, both offshore and land based. Its attempts to stop offshore wind included the same approach at issue in this case: Claim that drone developments mean that radar interference by wind turbines creates a national security risk. The courts were not sympathetic to this claim, including in cases where judges examined a classified report that the DoD was using to justify blocking offshore wind construction. As a result, the administration has turned to paying companies not to pursue wind development.
In parallel, the government was pursuing a similar approach for onshore wind. Here, a law lays out a process for the DoD to evaluate any problems posed by wind turbines and negotiate changes to planned wind farms with the developers. As laid out in the new decision, the government simply stopped participating in this process in August 2025, first by refusing to sign off on previously negotiated agreements, and later by refusing to draft agreements entirely. Eventually, it simply refused to participate in negotiations at all. This has brought a halt to all wind development in the US.
Apple faces a $32.5 billion lawsuit over how its Photos app scans and stores faces. A federal judge cleared the case to proceed as a class action late last month, allowing millions of Illinois iPhone owners to join.
The case has been years in the making, and Apple has fought to shut it down at nearly every turn. Now it heads back to the court, with the company’s privacy practices on trial.
[…]
Court records have shown that the update applies to users with iCloud Photos turned on. Those accounts also need to use at least 10GB of storage and contain at least 5,000 photos and videos. Plaintiffs say all this amounts to collecting biometric data without consent, putting Apple squarely at odds with Illinois law.
Again, I find it odd that features are apparently gated based on the capacity of your iCloud account rather than the available storage.
The lawsuit accuses Apple of collecting biometric data without user consent in the Photos app, reportsThe Times. It is alleged that Photos uses facial recognition technology to scan individuals who appear in images, creating a “faceprint” for each person in the photo library.
After collecting enough samples, an algorithm is allegedly used to identify the iPhone user. That data is then stored on the iPhone within the Photos app.
I don’t see what the issue is here. My understanding is that it only uploads vectors after you’ve opted in by enabling iCloud Photos and manually assigning names. Also, the vectors don’t seem like the sort of biometric information that the law was meant to protect.
Assuming things are working properly, what should happen is that the people you have specifically named and the photos you have specifically verified sync their info via iCloud. However, the actual face detection for the rest of the photos is done on a per device basis and is not synced via iCloud, primarily for security/privacy reasons.
So, when you first set up a new device, it will pull down the names and info for the photos where you have identified a particular person, but then it still needs to go through the entire library on-device, identify the faces in each photo, and compare them to the synced information to tell which person is in which photo. So once it’s done, you should end up with mostly the same photos identified as each person, but each device still needs to do its own face detection locally.
Apple lawsuit against OpenAI has reached its first major procedural challenge, with the ChatGPT developer asking a US federal judge to dismiss allegations that it acquired or used trade secrets taken by former Apple employees.
OpenAI submitted its 31-page dismissal motion on Wednesday in the US District Court for the Northern District of California. The filing argues that Apple has not adequately identified protectable trade secrets or alleged facts showing that OpenAI misappropriated confidential information.
Apple filed the case on July 10 against OpenAI, its io Products hardware operation, former Apple Vice President Tang Yew Tan, and former electrical engineer Chang Liu. The complaint accuses the defendants of obtaining information connected to Apple’s product development, manufacturing, components, testing, and supply chain operations.
The allegations have not been proven, and OpenAI denies possessing or seeking Apple’s trade secrets. US District Judge Edward Davila must now decide whether Apple’s complaint contains enough factual detail for the litigation to continue.
OpenAI Challenges the Apple Lawsuit
OpenAI’s motion focuses initially on how Apple described the information it claims was stolen. According to OpenAI, the complaint relies on generalized product-development categories without identifying the protected information with enough precision.
Trade secret plaintiffs face a difficult balance at the beginning of litigation. Apple must describe the protected material sufficiently to establish a plausible legal claim, but revealing the material publicly could expose the same information it is trying to protect.
Sensitive details can later be handled under seal or through a protective order. At the dismissal stage, however, Apple must still provide enough information for the court to distinguish genuine trade secrets from general engineering knowledge, employee experience, or skills acquired through years of work.
OpenAI argues that Apple has not crossed that threshold. Its motion says the complaint fails to establish ownership of a protectable trade secret and does not plausibly allege that OpenAI acquired, disclosed, or used such information.
The filing also disputes the commercial premise behind Apple’s accusations. OpenAI says it is developing products that are different from Apple’s hardware and has no need or desire to use the iPhone maker’s confidential material.
That position does not settle whether information was taken. A company can potentially misappropriate trade secrets even when its eventual product has a different design. The court’s immediate task is narrower: determining whether Apple has alleged facts that could support its claims if those facts are later proven.
Apple Park | Image Source: Google
Disputed Access to Apple Information
Apple’s complaint centers partly on Chang Liu, who spent eight years working as a senior system electrical engineer at the company before joining OpenAI in January 2026.
Apple alleges that Liu retained an Apple-issued computer and accessed confidential technical information after leaving. It claims he exploited residual authentication access on multiple occasions to obtain internal documents while already working for OpenAI.
OpenAI presents a different explanation. It says Apple employees contacted Liu after his departure and asked him to help locate files needed for ongoing Apple work. The company published redacted messages that it says support this account.
OpenAI argues that Apple’s systems and policies allowed personal and corporate information to become intermingled through iCloud accounts. Former employees, it says, could retain access to Apple files without requesting it or realizing that access remained active.
The motion maintains that Apple cannot treat the foreseeable effects of its own access-management practices as proof that former employees intentionally stole data. Apple, in contrast, alleges that its records document repeated access to restricted information rather than an accidental discovery of lingering permissions.
These competing accounts are likely to become central if the case enters discovery. Authentication logs, downloaded files, device records, internal communications, and employment timelines could establish whether access was deliberate, what information was obtained, and whether it reached anyone working on OpenAI products.
A dismissal motion normally tests whether the complaint states a legally sufficient claim. It is not a trial, and the judge is not expected to resolve every factual disagreement using competing evidence at this point.
Tang Tan and OpenAI’s Hardware Team
Apple separately accuses Tang Tan, OpenAI’s chief hardware officer, of seeking confidential information from Apple employees during recruiting conversations.
Tan spent more than 24 years at Apple and worked on products including the iPhone, Apple Watch, AirPods, and iPod. He later helped establish io Products with former Apple design chief Jony Ive and other collaborators. OpenAI acquired the hardware company as part of its effort to create a family of devices built around artificial intelligence.
Apple alleges that Tan used confidential project names, retained internal materials, and encouraged job candidates to discuss unreleased components or bring physical parts to interviews. OpenAI rejects the claim that these interactions formed a coordinated effort to collect Apple secrets.
OpenAI says Tan repeatedly instructed employees that confidential information from previous employers could not be brought into its organization. It also offers an alternative explanation for an Apple offboarding document found in his possession, arguing that Tan retained it to help incoming employees comply with Apple’s departure procedures.
Apple’s position is that the document and recruiting communications must be examined alongside the other alleged conduct. It describes the events as part of a connected campaign rather than isolated employment or administrative issues.
The dispute comes during intense competition for engineers capable of developing consumer AI hardware. Apple alleges that more than 400 former employees have moved to OpenAI, although hiring people from a competitor does not by itself establish trade secret misappropriation.
A company must generally connect recruitment to the acquisition, disclosure, or use of protected information. OpenAI is relying heavily on that distinction, presenting Apple’s lawsuit as an attempt to respond to employee departures and its difficulties competing for AI talent.
Image Credit: Getty Images
Apple Seeks Immediate Restrictions
OpenAI’s dismissal request arrives shortly after Apple asked the court for a preliminary injunction. Apple wants restrictions imposed while the lawsuit proceeds, arguing that it could suffer harm if its confidential information is used during OpenAI’s hardware development.
The requested relief would prevent OpenAI and the individual defendants from acquiring, accessing, using, or disclosing the alleged trade secrets. Apple has also requested expedited discovery and forensic examination of relevant devices and accounts.
OpenAI says those restrictions are unnecessary because it does not possess or want Apple’s protected information. It has described Apple’s request as based on false information and has offered to cooperate in addressing specific concerns.
The two companies also disagree over their communications before the lawsuit. Apple initially said its concerns had been raised with OpenAI months earlier. OpenAI responded that Apple’s outside lawyers contacted the wrong person after confusing names and incorrectly described a conversation with OpenAI’s general counsel.
OpenAI says Apple did not present the specific accusations before filing the case and that the companies had previously discussed resolving any access issues. Apple has since provided additional information in support of its injunction request, including allegations involving other former employees.
These disputes have moved beyond ordinary court filings. OpenAI published messages and emails on its website to support its version of events, calling Apple’s lawsuit aggressive and poorly investigated. Apple has primarily presented its account through formal legal submissions.
Judge Davila could dismiss some or all of Apple’s claims, deny the motion, or allow Apple to amend its complaint with more specific allegations. Even a dismissal would not necessarily end the case if permission to revise the complaint is granted.
The next scheduled public test is an October 1 hearing covering Apple’s preliminary injunction and request for early discovery. That proceeding may determine whether OpenAI faces immediate limits on its hardware work before the underlying trade secret claims receive a full evidentiary review.
Apple is now seeking a preliminary injunction in its trade secrets case against OpenAI, which aims to stop the AI model maker from moving forward with developing an AI device or other products based on Apple’s technology. […] In a new filing, Apple is requesting expedited discovery from the accused OpenAI employees, senior systems engineer Chang Liu and Chief Hardware Officer Tang Yew Tan; OpenAI, and its foundation; and io, the device startup co-founded by Apple’s former lead designer Jony Ive.
Apple had claimed that they contacted OpenAI in February and that we didn’t respond. They now admit that their outside lawyers emailed the wrong person after confusing two Asian last names—only after we brought this to their attention. Apple also claimed they had a discussion with our General Counsel, which they now concede never happened. But they again hide the fact that they never raised the specific allegations in this lawsuit at that time, and that they in fact told us that they were “resolving any issues”. We then heard nothing for five months until they sued. In their latest filing, Apple tries hard to spin this sequence of events, but you can just read the emails for yourself here.
Apple accuses Chang Liu of accessing Apple confidential information after leaving the company, but only now admits that Apple employees reached out to him and asked for his help to locate this information (you can read the messages here). Apple now tries to shift the blame to “residual access”, but they also don’t disclose that this is a common issue with Apple which is caused by them failing to properly manage system access when people leave. What that means in practice is that former employees who are trying to do the right thing when they leave still have access to Apple files—despite not wanting them or even being aware of them.
What it does not even touch is the accusation that Chang Liu retained his Apple laptop, which seems to be proven by what OpenAI posted. Apple further says that Liu entered shared network folders after leaving the company, and did so to download dozens of confidential files.
Then, too, OpenAI ignores the specific further accusation that ex-Apple employee Tang Tan both emailed documents to himself and sought trade secrets from employees he was recruiting for the ChatGPT company.
What really matters is the claim that Apple never raised those issues in the lawsuit with them. OpenAI claims the emails prove this, but to me all the emails prove is Apple sent an email that said “please see the attached letters”. We don’t know what is in the attachments but I imagine those were the relevant issues they raised.
[…]
The fact that the lawyer emailed the wrong person is moot if they caught it and resolved it days later.
In OpenAI’s phrasing, it sounds like Apple’s attorney sent the entire initial letter of concern to the wrong person, and that’s why OpenAI never responded — because it wasn’t sent to the correct person (OpenAI general counsel Che Chang). That’s not what happened. The initial blockbuster “hey we think you guys are stealing our trade secrets and we want to talk to you about it” letter was sent to Che Chang. And Che Chang never did respond to Apple’s lawyers. That a mistaken email thanking Che Chang for a phone call that never happened (because that email was intended for another OpenAI employee) was also sent is irrelevant. I don’t understand why OpenAI is continuing to focus on this inconsequential mistake.
[…]
The iMessage transcripts that OpenAI provides at the bottom of their post do not contradict Apple’s claims at all. […] Apple also claims that Liu accessed confidential information, presumably in Box and definitely not in iCloud Drive, on five different occasions, up until 27 April 2026, over three months after he left Apple. These chat transcripts offer no explanation for that.
[…]
To me, the most interesting response from OpenAI wasn’t their blog post, and was in fact released by Apple, as “Exhibit F” to one of their expert declarations submitted to the court last night.
The way Apple combines work and personal iCloud accounts left some employees able to access confidential documents after departing the company, reports The Information. The site spoke to more than half a dozen former Apple employees who were unknowingly left with access to sensitive content.
[…]
Apple told The Information that the OpenAI lawsuit is unrelated to any files left available on iCloud and that it does not pursue legal claims against former employees who accidentally have Apple documents in their personal iCloud accounts.
[…]
In a now-settled legal dispute, chip company Rivos claimed Apple intentionally lets former employees retain access to files “as part of a planned effort to generate a pretextual basis to sue the employees and their new employer for ‘stealing’ Apple material.” In the Rivos case, an employee was targeted for keeping work files in his personal iCloud account.
The documents included confidential material such as plans for product launch events. The former employees said they made no effort to retain access and unexpectedly found the files mixed with their personal iCloud data.
The problem reportedly grew from Apple’s practice of encouraging employees to connect their personal Apple IDs to company-funded iCloud storage.
[…]
Apple also relied heavily on iMessage for workplace conversations and file sharing before rolling out Slack around 2019. Former employees could retain old iMessage conversations and attachments, while Apple could terminate their Slack access when they left.
If you use your personal Apple ID, you get a magic “Apple Work” folder in iCloud Drive. When you leave Apple, that “Apple Work” folder disappears. But any other files or folders that were shared with you that were outside that magic folder are still in your iCloud Drive, because it’s still your personal iCloud account.
[…]
You still have the same Apple ID account, even though you no longer have an employee @apple.com email account. Overall, this is a humane way of dealing with digital identity. Your Apple ID account is you, the person, not “example@icloud.com”, one specific unique email address. And you, the person, may well have multiple email addresses — all of which can be associated with your one Apple ID account. That makes Apple IDs more nuanced and complicated than a simple mapping of one email address = one account. And it obviously makes access restrictions more complicated.
Yesterday, OpenAI released messages to show that Apple employees (with permission) retained access to the departing employee’s personal iCloud account so that they could access work files that were stored there. It’s just a mess that both the software and corporate policy encourage mixing everything in one account.
The company said his performance was the reason, according to a lawsuit Boardman filed in San Francisco Superior Court. Boardman says that explanation was a pretext. His version of the story begins three years earlier, inside Apple’s technical relationship with the largest wireless carriers in the United States, with a category of data capable of identifying nearly every phone on the network.
[…]
Apple considered serial numbers and IMEIs personally identifiable information under its internal policies, Boardman alleges. Representatives working with carriers other than AT&T required the carrier to obtain a customer release before Apple supplied the data. The Apple representative assigned to AT&T did not enforce that requirement, according to the complaint. Boardman says the identifiers were then transmitted through “unsecured email communications.”
He reported the practice to his manager and sought guidance from Apple’s legal department. He alleges that the company never gave him a written response.
I don’t think he has much of a legal case. Apple was probably within its rights to fire him if what he refused to do was against company policy but not illegal. It doesn’t sound like Apple is disputing that, at least not yet.
However, I think this is interesting because:
This seems to be another case, like yesterday’s story, where the interests of the customer and the carrier are at odds, and Apple leans towards the latter.
It shows that a policy is no guarantee, because it depends on humans choosing to follow it. There are other cases where Apple has been able to engineer privacy into the system. But some data is not end-to-end encrypted, so consent is a formal but a not technical requirement.
Tesla is asking a federal judge for emergency access to a supplier’s plant in Troy, Texas, so it can haul out the tooling it needs to keep building the Cybertruck.
The supplier, Angstrom Automotive Group, is closing the plant and won’t let Tesla in. Tesla says that without those dies, several thousand Cybertrucks already committed to customers don’t get built.
The complaint alleges that Apple violated California’s Consumers Legal Remedies Act and other laws by failing to adequately review and monitor apps distributed through the App Store, despite marketing it as “a safe and trusted place to discover and download apps.” Due to these assurances in Apple’s marketing, the complaint said the plaintiffs trusted that a Sparrow Wallet app they downloaded from the App Store on iOS was legitimate, when in reality it was a fraudulent spoof designed to steal Bitcoin from users.
Sparrow Wallet is only available on Windows, macOS, and Linux. The popular Bitcoin wallet is not available on iOS, but scammers have released fake lookalike apps in the App Store that can trick users into giving up control of their funds.
[…]
Even when victims reported fraud, the lawsuit alleges that Apple often took little to no action, and it says other fake Sparrow apps remain in the App Store.
Sparrow Wallet developer Craig Raw has publicly addressed Apple’s slow response to multiple fake versions of his app appearing in the App Store. In a January 2024 social media post, for example, he said “there is still a scam ‘Sparrow Wallet’ app on the @Apple App Store, despite myself and others having reported it weeks ago.”
My attempt to protect users from scam apps on the
@AppStore
has gotten my Apple Developer account flagged for termination - ironically, for “dishonest activity”.
[…]
I’m the developer of the real Sparrow Wallet, a desktop app, and I hold the registered US trademarks for the name and logo. I have publicly warned
@Apple
and the community about these fake apps from early 2024, but they keep appearing.
The app
@Apple
flagged was a placeholder that was never published. Its only purpose was to warn users that Sparrow is desktop-only and that other “Sparrow” apps aren’t mine. This approach may have been misguided, but there was nothing dishonest about it.
In response to our request for comment, Apple said it has taken swift action to remove any apps impersonating Sparrow Wallet[…] Apple says it takes immediate action against apps that do not comply with its guidelines.
The complaint targets one of Apple’s longtime competitive arguments: that its tight control over its App Store makes its platform safer than those offered by its rivals. The company has used this claim to push back against deregulation of the app ecosystem, including third-party app stores and sideloading.
“As part of a sustained marketing campaign, Apple has positioned itself, its products and services, as offering a level of security and trustworthiness superior to any competing technology company,” the new filing states. “This includes assurances about the safety of applications distributed through its App Store. By retaining exclusive control over which apps are permitted on Apple devices, Apple has structured its platform to ensure that consumers depend entirely on its promise of safety and reliability,” it reads.
With third-party app stores, there would be an incentive to do better vetting than Apple, and with sideloading it would be clear that the app was not being downloaded from sparrowwallet.com.
What struck me about Apple’s response is that it places the burden of curating the App Store on developers and users rather than taking responsibility for it. After all, Apple reviews every version of every app before it can be published to the App Store. If Apple is curating the App Store, then why do scams have to be reported and removed? One wonders how the scams get past Apple review in the first place, and even if Apple review “is not perfect” (a gross euphemism), how the second line of defense, Apple employees patrolling the App Store for scams that the review team missed, also fails. The burden of App Store curation should not fall to me, a lone indie developer.
Apple’s response also ignores that the indie developer did report the scams, multiple times.
Tesla has confidentially settled with three of the five named plaintiffs in the racism lawsuit that has been hanging over its Fremont factory since 2017.
That doesn’t end much. Up to 580 Black workers are still suing over conditions at the same plant, and California’s civil rights agency is taking its own case to a jury.
A federal judge has approved a $1.5 billion copyright settlement in which artificial intelligence company Anthropic will pay thousands of authors about $3,000 per book after using pirated copies of their works to train its Claude chatbot.
[…]
Bestselling thriller novelist Andrea Bartz first brought the suit with two other authors in 2024. It’s the first major settlement in dozens of AI copyright lawsuits that are still working their way through courts.
There doesn’t appear to be any other path for appeal or recourse, as the judge rejected both requests for either a new judgement or trial.
[…]
In the end, Masimo didn’t succeed in getting the Apple Watch banned or fundamentally redesigned. It won an empty victory with the funds it will be paid, and the patents affecting the lawsuit will expire in 2028 and 2029 anyway.
Although the ruling confirms the financial penalty, it does not affect current Apple Watch users. The smartwatch’s blood oxygen monitoring feature remains available after Apple introduced a software update in January 2024 that allowed sales to continue despite earlier legal challenges.
The AI music generation tool Suno scraped millions of songs and lyrics from YouTube Music, Deezer, and Genius, as well as from the stock music libraries Pond5, Jamendo, Freesound, the International Music Score Library Project, and podcasts via RSS feeds, according to a hacker who breached the company and shared data about Suno’s training libraries with 404 Media. The hacker was also able to access user information for hundreds of thousands of Suno’s customers, as well as Stripe payment information, they said.
[…]
As part of these legal proceedings, Suno previously admitted that it was trained on “essentially all music files of reasonable quality that are accessible on the open internet,” which included a total of “tens of millions of recordings.” Suno has been making the argument that it is allowed to train on copyrighted works as fair use in those cases, one of which has been settled.
Suno has long acknowledged that its AI music generator relied on the scraping of millions of songs available across the internet, but a new hack reveals just how the company pulled from streaming services and websites[…] all while user information remained vulnerable.
[…]
“Our goal has always been to help people create original new music, not replicate someone else’s. That’s why we build our models around what we call ‘Original Creation, By Design,’” the spokesperson said in a statement. “For example, we intentionally do not use artist names as a category of training metadata because we want our models to help people create brand new songs, not music that replicates other artists’ existing work. It’s also why we built Suno with detection filters that block or prevent a user from using specific artist, song, or album names as prompts, and prevent users from uploading lyrics or sound recordings that match existing works.”
The iPhone maker alleges that this misconduct, which it says reveals a pattern of theft from OpenAI employees who previously worked at Apple, was directed by OpenAI’s senior leadership, including Chief Hardware OfficerTang Tan.
The lawsuit, which was filed in the U.S. District Court for the Northern District of California, accuses Tan of using Apple’s confidential project code names during OpenAI’s recruiting process, asking job candidates to bring in Apple hardware components to their interviews, coaching departing Apple employees on how to evade the company’s security procedures, and asking for details about the company’s unannounced products.
Apple’s allegations are detailed and shocking, and it sounds like they have a lot of evidence.
The lawsuit names Chang Liu and Tang Tan as two of the defendants. Tang Tan served as VP of product design at Apple, leading iPhone and Apple Watch product design. He departed the company in February 2024 to work with Jony Ive. Chang Liu, meanwhile, worked at Apple for eight years and was a senior system electrical engineer before departing to join OpenAI in January 2026.
Apple’s lawsuit also names OpenAI and io Products as defendants.
OpenAI’s hardware efforts are being led by Jony Ive, Apple’s former chief design officer.
[…]
Ive, Hankey, and Cannon are not personally mentioned anywhere in Apple’s initial filing today.
OpenAI’s Director of Strategic Communications, Drew Pusateri, took to X to comment on the company’s behalf.
In his post, he claims OpenAI has “no interest in other companies’ trade secrets,” adding that OpenAI remains “focused on building innovative technology that empowers people everywhere.”
This seems like a weak response, given that Apple says it reported its findings to OpenAI in February and never heard back. Presumably, they’ve already investigated but see the situation as serious enough that they need to say as little as possible.
It’s not clear to me the extent to which Apple believes the behavior was limited to the named defendants. It’s hard to believe that the rest of OpenAI’s leadership—including Altman and Ive—were unaware, given the scale of their recruiting from Apple. It’s equally hard to believe that they were aware and thought they could get away with it. I guess little from Altman would surprise me at this point. I’d like to believe that Ive wasn’t part of it, but then are we to believe that his former coworkers all kept him in the dark?
What is immediately notable about this whole thing is the myriad conflicts of interest. Apple, of course, has a current partnership with OpenAI to power Apple Intelligence features, something repeatedly mentioned on the previous version of its marketing webpage, and conspicuously absent on the current one.
But the history runs far deeper. Among the defendants in the suit is io Products — do not blame me for that capitalization choice — founded by Jony Ive and acquired by OpenAI last May. Total mentions of “Ive” in the body of this lawsuit? Zero. Also, one of the investors in Ive’s company was Emerson Collective, founded by Laurene Powell Jobs, and which now has equity in OpenAI. Neither Emerson nor Powell Jobs are defendants.
It all reads a bit as if Apple has been building up evidence of these allegations for some time and recently got their smoking gun. It’s not just nebulous “trade secrets” either, there are specific mentions down to “metal finishing techniques” that Apple apparently invented and protected.
It also comes a little less than a month after OpenAI was rumored to be threatening Apple with a lawsuit over the perceived failure of their deal to bake ChatGPT into the iPhone. As I wrote at the time, even just that threat was clearly not going to go over well in Cupertino.
Apple and OpenAI have a commercial relationship involving the
integration of OpenAI’s ChatGPT into Apple Intelligence. The
companies have entered into a written agreement governing that
integration. That agreement is not at issue here. OpenAI’s acts of
trade secret misappropriation alleged herein do not arise from and
have no connection to that agreement.
Be that as it may legally speaking, in practical terms it seems untenable for that Apple Intelligence partnership to continue after this.
Namely, while Apple frames OpenAI – or at least its fledgling hardware division – as “rotten to its core” (interesting terminology!), they really only have a case against two and maybe three individuals. But they also clearly believe that if this case goes to trial, they will have a case against a lot more.
[…]
The parallels to the Anthony Levandowski situation after he left Google for Uber have been drawn.
[…]
It is interesting that Apple is not suing Yu-Ting “Alyssa” Peng, who is named in the suit as a co-conspirator with Liu while she was still employed at Apple, before she also subsequently went to work at OpenAI. Is it possible she’s cooperating or has cooperated with Apple in this investigation?
[…]
Even if these allegations are found to be untrue or embellished, can he reasonably stay at OpenAI now? And perhaps that’s the real outcome Apple is looking for here, as they clearly frame him as the ringleader of the 400-plus people who have come over to OpenAI from Apple.
OpenAI’s ambitions to build a hardware rival to the iPhone are already running into trouble because of Apple’s trade secret lawsuit, according to Bloomberg’s Mark Gurman, who argues the damage is showing up well before any court ruling.
[…]
The scale of the talent drain is a major part of why this matters to Apple. More than 400 former Apple employees now work at OpenAI, including former Apple design chief Jony Ive, and Gurman says the company poached so heavily from Apple’s iPhone product design group specifically that Apple had to rebuild parts of the team. Apple has responded with bigger retention bonuses and executives personally working to keep engineers from leaving.
I can’t believe this awful company solicited confidential information and stolen trade secrets, hiring from this other company while pretending to partner with them. ‘Rotten to the core’ indeed
Apple has reportedly sent legal letters to dozens of former Apple employees now working at OpenAI, telling them to preserve potentially relevant documents and communications as it continues to pursue its trade secret lawsuit against the AI company.
Apple’s challenge against the EU’s designation of its App Stores and iOS platform as “gatekeepers” was dismissed by Europe’s top court on Wednesday, reports Reuters.
[…]
The company also disputed the classification of iMessage as a number-independent interpersonal communications service, or NIICS, which would subject the app to EU telecoms rules. But the General Court said Apple’s actions regarding the iMessage service are inadmissible.
Back in 2023, Apple acknowledged that it qualified under the then-new definition of being what the EU called a gatekeeper service. But key to that is the size of the operation, and since 2024, Apple has been claiming it runs five smaller App Stores rather than one large one.
[…]
“Irrespective of the devices in question,” ruled the judges, “those stores have the same purpose, namely to connect app developers with end users in order to facilitate the distribution of software applications.”
Apple disagreed with the decision but didn’t say yet if it would appeal. “We firmly believe the DMA’s mandate goes beyond what is lawful and proportionate, threatening to erode decades of privacy and security protections we’ve built and leaving our users vulnerable to new risks,” an Apple spokesperson said in a statement to multipleoutlets. “We will continue advocating for the innovation and privacy our European customers deserve.”
Apple still has two cases pending with EU courts. The first is a challenge to the EU Commission’s decision last year forcing Apple to open iOS to third-party developers, and the second is an appeal against the €500 million fine imposed in April last year for anti-steering violations.
A vulnerability in Apple’s “Hide My Email” tool lets almost anyone discover a person’s real email address that is supposed to be hidden by the feature, and Apple has failed to fix it for more than a year, according to a security researcher and 404 Media’s own tests.
[…]
“Apple Hide My Email is leaking email addresses that are supposed to be hidden. We reported the issue and replication instructions to Apple over a year ago. We don’t know why it hasn’t been fixed, but we don’t feel comfortable waiting any longer. Hide My Email users deserve to know that it may be possible for attackers to discover their hidden email addresses,” Tyler Murphy, the co-founder of EasyOptOuts, which discovered and reported the issue to Apple, told 404 Media.
“Free, publicly accessible people-search sites make it easy to link an email address to other personal details, so people relying on Hide My Email for safety may be at risk,” Murphy added.
[…]
To test the issue I generated a new Hide My Email address and provided it to Murphy. Around five minutes later, he replied with my real email address linked to my Apple account which was supposed to be hidden.
Murphy said that he reported the issue to Apple in June of last year, and the company told him it was looking into it. Apple said it had been fixed in March of this year, but Murphy found that wasn’t the case. He again contacted Apple, with the company saying that it would appreciate him not revealing the existence of the flaw until it had been resolved.
Apple then said it planned to address the issue in June, but since it still hasn’t been fixed[…]
March 19, 2026: Using the reproduction instructions from our initial report, we determined that the vulnerabilities hadn’t been fixed.
May 22, 2026: We realized that the vulnerabilities may have greater severity and scope than we thought initially and reported this to Apple. Apple never acknowledged the report of increased severity.
June 30, 2026: Apple again reported that the vulnerabilities were fixed and asked us to verify. We determined that the vulnerabilities hadn’t been fixed.
Very few details are available right now. I have seen speculation that the original email address is revealed when someone replies using their hidden email address, but the impression I get from Cox’s reporting is that no user interaction is necessary[…]
[…]
I am also unclear about how, as of May, the EasyOptOuts guys found the “vulnerability may have greater severity and scope” than initially reported. Ominous, though.
I don’t know whether I’ve accidentally stumbled upon that vulnerability, or perhaps in this case the Hide My Email user just messed up in some way, but I’ve definitely discovered a bizarre and troubling Hide My Email bug in Mail app (on macOS Sequoia 15.7.7).
[…]
Bizarrely, however, Mail app displayed an alert that I’ve never seen before, “This message was forwarded to you by Hide My Email,” despite the fact that I have previously received many emails from people using Hide My Email.
[…]
Why I am seeing two different @icloud.com email addresses, one of which appears to be the sender’s unhidden address?
Why are the To: and From: fields in my reply disabled?
Why is my reply not from my @underpassapp.com email address but rather displayed falsely as from the sender’s @icloud.com address and really from my unrelated Apple Account address?
Apple this week was sued over a reported “Hide My Email” flaw that could expose a user’s real email address. The proposed class action lawsuit alleges that Apple violated California’s false advertising law and other consumer protection statutes by knowingly offering a feature that does not work as advertised.
This is interesting in that the June 2025 bug report is the evidence that Apple “knew” the feature didn’t work, while “Apple continued to represent to consumers that Hide My Email
would actually hide users’ email.” How long are they supposed to get to fix a bug?
The misleading user interface elements in Mail app are a bug, but by themselves they’re not a vulnerability. The vulnerability is that when I send a reply to my maliciously crafted email, my Apple account email address is disclosed in the “From” field of the sent reply! In other words, the Mail app interface lies, fails to show the true sent value of the “From” field.
There are a couple of crazy aspects to this information disclosure vulnerability:
It does not require that the victim actually use Hide My Email! I never use it. As I mentioned in my previous blog post, I don’t even have an icloud.com email account.
It does not matter which of the victim’s email accounts receives the email from the attacker. If your Apple account email address is a@foo.com, but you receive a maliciously crafted email addressed to b@bar.com, Mail app will still send your reply from a@foo.com, thereby disclosing your Apple account address.
Apple addressed a vulnerability in Hide My Email that exposed a user's real email address, reports 404 Media. Apple told the site the issue was fully fixed in a patch released on July 3.
[…]
While the bug has now been addressed, email logs that pre-date the fix could still expose user email addresses.
The social media company Meta and the video streaming service YouTube harmed a young user with design features that were addictive and led to her mental health distress, a jury found on Wednesday, a landmark decision that could open social media companies to more lawsuits over users’ well-being.
[…]
Citing features like infinite scroll and algorithmic recommendations, K.G.M. sued Meta, which owns Instagram and Facebook, and Google’s YouTube, claiming they led to anxiety and depression.
For its part, the Wall Street Journal editorial board is standing up for beleaguered social media companies in an editorial today criticizing everything about these verdicts, including this specific means of liability, which it calls a “dodge” around Section 230.
[…]
Product design, though, is a different question. It would be a mistake, I think, to read Section 230 as a blanket allowance for any way platforms wish to use or display users’ posts. (Update: In part, that is because it is a free speech question.) From my entirely layman perspective, it has never struck me as entirely reasonable that the recommendations systems of these platforms should have no duty or expectation of care.
To me, a non-lawyer, much of the actual text of the ruling (PDF) explaining why this lawsuit was not immediately turfed on Section 230 grounds seems pretty reasonable. For example, the judge says “[u]nder the default settings, Meta enables approximately forty types of notifications” for the Instagram app, which the government alleges “is designed to overwhelm young users and compel them repeatedly to reopen Instagram”. We can argue whether this is a meaningful thing for a government to police or if it is just another example of Meta resorting to tacky growth-hacking techniques instead of trusting their product is sufficiently compelling on its own. (Most days when I open Instagram in my browser, it puts a red badge over the notifications tab and suggests I have one new follower. I do not; I never have. It lies to me every time, presumably because it knows most people, including me, will usually click on that, thereby increasing a number on a dashboard somewhere.)
couple weeks back, Jonathan Haidt published another entry in his ongoing campaign to convince the world that social media is inherently ruining kids’ lives. This one was a victory lap titled “Seven Lines of Evidence Against Social Media,” treating recent developments — including the social media addiction verdicts against Meta that most people are misunderstanding — as vindication of his thesis.
Indeed, the research repeatedly suggests that for the very small number of kids who are facing mental health problems and overrelying on social media in response, the answer is a targeted intervention to help those individuals — not a broad “ban kids from social media” program.
A group of 48 China-based iOS developers have filed an antitrust complaint against Apple with the country’s market regulator over the App Store’s commission rates, the South China Morning Post reports.
The developers sent an open letter to China’s State Administration for Market Regulation (SAMR), alleging that Apple failed to deliver on a promise to offer the lowest commission rate to the Chinese market. The group asked the SAMR to investigate and penalize Apple for allegedly abusing its market dominance to impose “unfair and excessively high” costs on local developers.
Apple lowered the fees in March but not as much as it did in Brazil and Japan.
Login
