Agent policy, enforced at the gateway and sandbox that constrains the agent, can stop IP leakage and contamination.
Post 8 of a series on AI liability for general counsels interested in the legal liability associated with building and using agents.
An employee pastes a customer list, a pricing model, or a draft contract into an agent to “just summarize it.” Or the agent is allowed to retain conversation history. Or it writes the content into a shared knowledge store another agent can read. Then a competitor’s blog post blasts your secret plan to the world. Or a plaintiff claims your agent reproduced their protected work. The quarantine folder doesn’t help. Once the material has been used as context in a foundation model, written into durable memory, or used to shape outputs, the damage is done.
Courts are already treating this as more than a training-data problem. Recent cases involve employees trade secrets to train or condition competing agents, and publishers alleging that model outputs reproduce protected reporting or lyrics. The seminal example is two mathematicians who were using OpenAI to solve the Navier-Stokes Millennium Prize Problem. They got very close to solving it, then OpenAI ran 10,000 agents for 88 hours and published a solution that looks like it was built on their foundational work. When called on it, OpenAI said they would not seek the $1M prize money, if he would drop his partner who also happened to work at Anthropic.
The exposure runs in both directions. Agents can contaminate your outputs with someone else’s IP. They can also irreversibly incorporate confidential material so that later outputs or other agents carry it forward. A policy that says “do not paste secrets” is not a control if the agent can still receive, retain, or redistribute contaminated material.
Most companies address IP leakage and contamination with training and acceptable-use language. Employees are told not to put confidential data into consumer tools. But now models that are trained on the world’s data and users’ data seem to be enabling wholesale IP redistribution.
Agents are given broad context windows because that is how they become useful. The data-class restriction that was supposed to stop source code, trade secrets, or protected works from becoming long-term context lives in one document. The runtime that was supposed to block the write or require approval lives in another. When the claim arrives, the answer is a reconstruction of what the agent was allowed to retain and whether anyone approved the persistence.
The practical requirements sit on top of the same acceptance criteria used for other risks. You need data-class rules that treat source code, confidential material, trade secrets, and protected works as restricted. You need explicit prohibitions on using those classes as long-term context, writing them to shared stores, or feeding them into training or fine-tuning paths. You need masking or human approval before high-risk outputs leave the agent. You need Analyzer-style checks that flag agents configured to retain history or write to durable memory when those classes are in scope. You need the intersection of those ceilings compiled into a signed contract the runtime enforces. You need traces that record whether restricted classes were touched, whether a write or persistence action occurred, and which policy version was in force.
At Trustabl we treat intellectual-property and trade-secret exposure as a data-class and persistence problem rather than a separate product. Company Policy can declare those classes restricted, prohibit copy-out and long-term retention, and require human approval or redaction before certain outputs. The compiler intersects those requirements with the other ceilings and produces one signed contract. It generates the corresponding policies for the Policy Enforcement Points (PEPs) so the restriction holds at runtime. The Safe Agent Control Plane records the data classes touched, the persistence decisions, and the approvals in the same evidence bundle. The open-source Safe Agent Builder tools help teams produce reliable agents that do not retain or redistribute restricted material by default. We do not claim this makes every output non-infringing. We claim it gives you a record that the organization prohibited or gated the behavior, which is the difference between a policy and a defense.
Agents will keep being asked to summarize, draft, and remember. The companies that can show restricted material was not permitted to become durable context will be in a different position from the companies that discover the contamination after their IP is publicly available.
Additional reading in this series
Related Blogs
Agent Reliability Resources
