CADChain Blog
2026-11-11 13:18 News

AI Code Theft Lawsuit: Point72's Cubist Says a Fired Analyst Used Claude Code and Codex to Distil Its Source Code. What Engineering Teams Should Learn About AI Agents | CADChain | CAD DRM & IP

Cubist Systematic Strategies, the quantitative trading arm of Point72, has sued a former lead research analyst in Connecticut, alleging that he used the company's own AI coding assistants, Claude Code and OpenAI Codex, to read his colleagues' research and source code and distil it into portable notes he could take to a rival. The verified complaint is dated 9 November 2026 and became public on 10 November.
According to the complaint, Xin Jin issued 4,117 queries across 2,416 sessions with the two tools between 28 February and 31 May 2026, nearly half of them outside normal working hours or at weekends. Cubist says he turned the output into markdown files, tested whether they were complete enough to rebuild the team's work elsewhere, deleted his AI history and photographed source code on his screen. Jin's lawyer says the claims are without merit. None of the allegations has been tested in court.
The case is about trading models, but the method is not specific to finance. Engineering teams now give AI agents read access to code, design notes and CAD automation, and the complaint is one of the first detailed public accounts of insider theft where the insider asks an assistant to summarise instead of copying files.
TL;DR: the alleged theft was a summary, not a file copy

Cubist says its former analyst used company-provided Claude Code and Codex to catalogue nearly every repository of his 14-person team and distil the research into textbook-style markdown files, including an 18-month study plan that matches his non-compete period. Documents he later handed over included photos of source code taken on Sunday 3 May 2026 and notes on more than 20 forecast models. Cubist caught it because it logged AI prompts and outputs and could recover the history he deleted. Lesson for engineering teams: AI agents widen what one person can read and condense in a few weeks, so access scope, prompt logs and file-level control matter more than ever.

What does Cubist allege the analyst did?

Jin joined Cubist in December 2019 as a research analyst on the KEPL team, a group of about 14 people led by portfolio manager Lei Xu that trades medium-frequency statistical arbitrage. He was later promoted to Research Analyst Lead. That role gave him access to colleagues' private repositories so he could review junior team members' code. The verified complaint says this access was meant for limited purposes, and that Xu had reminded the team by email on 6 December 2025 not to search other people's folders unrelated to their work, even if a permission happened to be set incorrectly.
The complaint quotes several prompts. On 21 March 2026, according to Cubist, Jin asked Claude Code to catalogue every notebook in a colleague's private research folder and extract every formula, regression, parameter and finding in maximum detail, saying it was for an academic paper. Cubist calls that a pretext.
In total, the complaint says Jin had Claude Code read 14 codebases without making any edits and issued over 600 prompts with exhaustive-read language such as "extract all" and "every formula", packaging the results into multi-chapter markdown compilations. In Cubist's words, "Jin plainly was data mining and synthesizing other people's work at Cubist in order to refine it and use it at a rival."

Why does AI distillation change insider risk?

Classic data loss prevention looks for files leaving: a USB drive, a cloud upload, a large email attachment. The complaint describes something different. The valuable part of the work was turned into plain-text summaries that are small, readable without special software and easy for another AI tool to process. Cubist even alleges, on information and belief, that Jin photographed his markdown files and used AI to turn the photos back into clean text on a personal computer, a route that never touches a monitored upload channel.
The most telling detail is the testing. According to the complaint, Jin asked Claude Code to act as a data engineer and check whether the features in his markdown chapters could be built from available data, running these checks against his summaries rather than the original repositories. Cubist argues the only purpose was to confirm the notes were enough to recreate the work elsewhere.
Engineers will recognise the pattern. Much of the know-how sits outside the native CAD file, in design rationale, tolerance studies, parameter tables and CAD scripts, and an agent that can read a PDM vault can condense years of it into a few documents. Our article on preventing CAD file exfiltration by former employees covers the classic routes. This case adds a new one.

How did Cubist detect it?

Cubist says it had team-restricted repositories, per-employee access limits, monitoring of which repositories employees open and, notably, logging of every AI prompt and its output. Detection still started with people. In July 2026 members of the KEPL team told Xu about Jin's behaviour, including questions unrelated to his work. According to the complaint he had told colleagues that he was buying market data and spending thousands of dollars a month on AI coding tools for home use, and that he was considering a personal computer with a terabyte of memory. Cubist's information security team then ran a forensic review of his AI usage. Jin had deleted his AI prompt history and a folder called scratch/research several times, but Cubist says it recovered the original AI usage logs.
That recovery is what turned suspicion into evidence. Logs that the user could not erase show the prompts, the times and the repositories involved. For engineering companies this is the practical lesson of audit trail requirements for IP litigation: you need records the person under suspicion cannot delete.

What did the analyst hand over, and what does he say?

In July Jin told HR he was considering a competitor, and Cubist put him on paid leave and froze his access. He denied holding confidential information but refused to sign a certification that he had not photographed it or used AI to distil, recreate or reverse-engineer it. On 16 September he said he had accepted an offer from an unnamed rival, and Cubist terminated him for cause on 18 September.
Jin refused a forensic review by a Cubist-approved vendor and used his own. On 27 October, the complaint says, he handed over a limited set of documents that included photos of source code taken on Sunday 3 May 2026, framed to show the whole screen with the directory structure and internal server connection details, and markdown files distilling more than 20 proprietary forecast models. Cubist says variable and function names match its codebase exactly. It also says a 44-terabyte external drive was deemed irrelevant by his side and reported as having stopped working during collection.
Jin disputes the case. According to Bloomberg's report, his lawyer Rollo Baker said the claims are without merit and that "Mr Jin looks forward to setting the record straight." Jin filed a court document on 10 November saying he has been cooperating in proposed mediation and is seeking more than US$30 million in investments and compensation he says he is owed. No court has ruled on the facts.

What is Cubist asking the court for?

The complaint has three counts, all for breach of Jin's 2019 employment agreement: the confidentiality clause, the 18-month non-compete and the clause on company inventions and records. The third count is unusual: Cubist argues that deleting the AI prompt history and output files destroyed the company's own records of its inventions and source code. The complaint does not include a statutory trade secret claim.
Cubist asked for a temporary restraining order without notice, an injunction, 18 months of non-compete from termination, return of all copies, a forensic inspection of Jin's personal devices by a Cubist-approved vendor, damages and disgorgement. The return date is 15 December 2026. We found no report of a ruling on the restraining order yet.
Alleged stepWhat the complaint saysEngineering equivalentControl that helps
Reach beyond the jobLead role gave access to colleagues' private repositoriesEngineer with vault-wide read rightsNeed-to-know folders and regular access audits
Distil with AIOver 600 exhaustive-read prompts across 14 codebasesAgent summarising design notes, macros and test dataScope agents per task; log every prompt and output
Test the summaryBuildability checks against his own markdown filesChecking a summary is enough to rebuild a part familyReview read-only bulk sessions with no edits
Take it outPhotos of screens; markdown files on personal devicesPhone photos of models and drawingsScreen capture controls and visible watermarks
Cover tracksAI history and output folder deleted several timesDeleted local exports and agent logsTamper-proof logs outside the user's reach
Use at a rival18-month study plan matching the non-competeRebuilt designs at a competitorDated proof of what you own
Know who opened which design file, and keep the record they cannot delete. CADChain encrypts CAD files at file level, lets you set and revoke permissions per user, logs every access and records ownership on a blockchain, across CAD systems.

👉 Protect your CAD files with CADChain

What does this mean for engineering teams in the EU?

Under the EU Trade Secrets Directive, information is only protected as a trade secret if its holder took reasonable steps to keep it secret, and acquiring it by unauthorised copying is unlawful. The safeguards Cubist lists, from access limits to prompt logging, are exactly the kind of evidence a court looks at when it asks about reasonable steps. Our trade secrets guide for deep tech startups explains the test in more detail.
Two European differences matter. Logging employees' AI prompts is processing of personal data under the GDPR, so it needs a clear purpose, transparency and proportionate retention, and in several countries the works council must be involved. Non-competes also differ by country. In Germany, for example, a post-contractual non-compete may last at most two years and is only binding if the employer pays compensation of at least half of the employee's last contractual remuneration. Contracts alone will rarely protect you, which is why our article on employee IP agreements for CAD files pairs them with technical controls.
The case also fits a wider pattern of disputes about what engineers take when they change jobs, from the Apple v. OpenAI trade secrets case to the LG Chem leak, where a departing expert photographed production conditions. Photos of screens appear again and again.

What should engineering teams do now?

  1. Inventory your AI agents. List every coding assistant, CAD copilot and agent that can read your repositories, PDM vault or file shares, and what each one can reach. Our check of Claude Fable 5.2 for CAD and hardware work and BORIS Inventor's article on the Inventor MCP server show how fast that access is growing.
  2. Scope access to the task. An agent should see what the current job needs, not everything its user can open. Review lead and admin roles that inherited broad read rights.
  3. Log prompts and outputs centrally. Keep agent logs where users cannot delete them, and tell staff that you do. Cubist's case rests on logs it could recover.
  4. Treat AI outputs as confidential files. Summaries, notes and generated documentation about your designs are as sensitive as the designs. Store them in managed locations, not personal scratch folders.
  5. Watch for read-only bulk patterns. Many sessions that read and extract without editing, at night or at weekends, deserve a look. Anomaly detection on CAD file access can flag them.
  6. Protect native files at file level. Encrypted CAD files with revocable permissions stay locked if copied. See our guide to CAD encryption.
  7. Plan the exit. Freeze access when someone announces a move to a competitor, ask for a written certification that includes AI use and photos, and agree how devices will be checked.
  8. Keep dated proof. Version history and timestamped ownership records make it possible to show that a summary was derived from your work, as Cubist does with matching variable names.

How does this fit the bigger picture?

Our sister sites covered other routes into engineering data this week:

Conclusion

If Cubist's account holds up, the Jin case shows how much an insider can condense with an AI coding assistant in three months: thousands of queries, a dozen codebases and a textbook of notes that fits on a phone. It also shows what caught it: colleagues who spoke up, prompt logs the user could not erase, and a clear written policy on what access was for. Jin denies the claims, and the court has not ruled.
The takeaway does not depend on the outcome: AI agents are becoming the fastest reader in the company, so give them narrow access, keep their logs out of the user's reach and protect native design files.
Protect design files that AI agents and people can reach. CADChain gives every CAD file a verifiable ownership record, file-level encryption, granular permissions you can revoke at any time and a full access log, so you can prove what is yours and who touched it.

👉 See how CADChain protects CAD files

FAQ: AI code theft lawsuit against a former Cubist analyst

What is the Cubist v. Jin case?

Cubist Systematic Strategies, Point72's quantitative trading unit, sued its former lead research analyst Xin Jin in Connecticut Superior Court in Stamford. The verified complaint, dated 9 November 2026, alleges he used Claude Code and OpenAI Codex to distil his team's research and source code for use at a rival.

How were the AI tools allegedly used?

According to the complaint, Jin sent 4,117 queries in 2,416 sessions between 28 February and 31 May 2026, told the assistants to read and extract everything from 14 codebases, packaged the results in markdown files and ran checks on whether the files were enough to rebuild the work.

What does Jin say?

His lawyer, Rollo Baker, told Bloomberg the claims are without merit. Jin filed a document on 10 November saying he has been cooperating in proposed mediation and is seeking more than US$30 million he says he is owed.

Has the court ruled?

Not as far as we could find on 11 November 2026. Cubist asked for a temporary restraining order, an injunction, return of its information and a forensic inspection of Jin's devices. The return date is 15 December 2026.

Were Anthropic or OpenAI at fault?

The complaint does not accuse them. Claude Code and Codex were company-provided tools that Jin allegedly misused. The case is about an employee's access and conduct, not a flaw in the tools.

How did Cubist detect the alleged theft?

Colleagues raised concerns in July 2026, and Cubist's information security team reviewed his AI usage. Cubist logged AI prompts and outputs and says it recovered the original logs after Jin deleted his history.

Can file-level encryption stop AI distillation?

Not on its own. Someone allowed to open a file can still summarise what they see. File-level encryption keeps copied native files locked, while scoped access, prompt logs and tamper-proof audit trails help detect and prove misuse.

How does CADChain help with insider risk?

CADChain encrypts CAD files at file level, lets you grant and revoke permissions per user, logs every access and records ownership on a blockchain. It works alongside access policies, agent logging and employment contracts, not instead of them.