Apple Didn't Get Hacked. It Forgot to Log Out.
Apple can engineer almost anything. What happened with the exit?
Apple didn’t lose trade secrets. It lost the exit interview.
THE SIGNAL
On Friday, July 10, 2026, Apple filed suit against OpenAI in the U.S. District Court for the Northern District of California.
The complaint names two people: Chang Liu, a former senior electrical engineer who kept his Apple laptop after leaving. Apparently, he discovered a bug giving him ongoing access to Apple’s internal file servers.
Then Tang Yew Tan, Apple’s former VP of product design for iPhone and Apple Watch. He’s now OpenAI’s chief hardware officer. The lawsuit claims over 400 former Apple employees now work at OpenAI.
The headline is a tech giant suing a rival for stolen secrets. The real story is smaller and worse. A departing engineer’s access to internal systems was never fully closed. How did that happen to a company that is so good at building systems?
THE FAILURE POINT
I’ve been consulting for 35 years. I’ve never seen what happens when someone leaves a company and how the badge and credentials process works. If this can happen at Apple, how many less tech-savvy companies miss this?
I should mention, I love Apple products. I’ve been using a Mac since around 2005; in fact, I have one of the old white vinyl MacBooks, and it still works.
We can see the exact failure point. It happened when Liu’s badge and laptop access weren’t shut down. Somewhere between HR processing the resignation and IT, the close-out failed. Was it a system glitch or did everyone assume someone else closed the loop?
Apple is not a company that lacks security infrastructure. It has some of the most guarded product development processes in consumer technology. That’s what makes this case instructive instead of embarrassing. The failure didn’t happen in a system that was weak everywhere. It would be interesting to sit in the boardroom and hear who is blaming who.
Worth checking where your own team sits on that same gap before assuming it's someone else's problem.
Score your gap →
SIGNAL WITHIN THE SIGNAL
If you’ve been reading my newsletters, you are probably familiar with a few terms: Norman’s Law, Signal Compression, and Norman’s Gap.
This is an example of Norman’s Gap, I describe it like this: when external pressure exceeds regulation (internal balance), then instability follows.
What is the risk when employees leave a company? We can come up with a substantial list. At Apple, AI talent is leaving in waves, and every departure carries operational risk.
I believe great systems should be designed to balance the external pressure and regulation so the process has low variability. If it’s true Apple is experiencing some level of an exodus, maybe the system wasn’t designed to handle this volume. Apple had the policy. It didn’t have the enforcement.
BEHAVIOR UNDER PRESSURE
When talent exits accelerate, security teams default to trust over verification. Access reviews get treated as a checkbox on an offboarding form instead of a hard gate that blocks the next hire’s start date.
I’ve spent a lot of time in leadership meetings, and turnover is seen as an HR metric, not a systems vulnerability. I’ve never heard that brought up, ever. Moving forward, I have some guidance to surface in those meetings.
In the lawsuit, Tan allegedly used Apple’s internal codenames to draw more detail out of candidates who were still employed. Then reportedly circulated an internal offboarding document that taught new hires how to go around Apple’s exit checks. That’s a system where someone should have known about this gap.
SYSTEM DRIVER (MOS) / LEADER DRIVER (IOS)
The fix isn’t a new policy. I’m sure Apple has one that has probably been looked at since this event. The fix, like a lot of what I stress here, is a named owner and a deadline attached to every departure. No exceptions.
Peter Drucker said it plainly. “What gets measured gets managed.” That confirmation belongs on a dashboard next to headcount and revenue.
Recently at work, I was involved in a discussion about actions from Tier meetings. If we are tracking and measuring the number of actions without a named owner, we could also be measuring the mean time to close an action. Then use that as feedback to the team to improve velocity of action closure.
If you have been involved with implementing a change, then you know the hard part is internal. Even in my own consulting experience, when I have let people go, I did it with compassion and never felt those employees were a risk. But in this case, the process wasn’t followed. I’ve often said that simply implementing a client’s own compliance with its systems would generate a measurable improvement.
IF YOU DO ONE THING TODAY
I try to offer a bit of guidance with each article. Take a look at the history for the last person who left your organization in the past 30 days.
Is it noted somewhere that every badge and remote access point was closed?
If you can’t confirm it in the next 60 minutes, you’ve just found your gap.
PRESSURE / REGULATE
Pressure: 8 / Regulation: 3
The pressure: departure speed outpacing process compliance.
FINAL SIGNAL
The trade secret was never the vulnerability. It was the exit.
CTA
Score your own gap here it takes about three minutes.
mosei.org - Gap-score
SOURCES
Bloomberg, Axios, NBC News, and The Washington Post reporting on Apple Inc. v. OpenAI et al., filed July 10, 2026, N.D. Cal.