AI Does Not Destroy Patent Rights: Bad Channels and Bad Judgment Do

An inventor pastes an unfiled disclosure into a chatbot to clean up the wording. An associate runs a draft specification through an AI tool to pressure-test claim support. A client forwards the analysis an AI gave them about their own case. All routine now, and each has produced a warning that AI quietly destroys patent rights: the prompt becomes prior art, novelty is lost, inventorship is corrupted, the application turns suspect. Some of those warnings are real. Most misidentify what went wrong.

The risk almost never comes from the AI model’s involvement. It comes from whether the information stayed confidential, and that turns on the channel it traveled through: the product and tier, the provider’s terms in force, the retention and training settings, who may see the data, where the output goes, the jurisdiction, and now the specific model. “I used AI” says as little about what happened to the work as “I used email.” The questions that matter are narrower: which channel carried the information, what obligations governed it, and could you prove those controls later.

Getting this wrong usually does not cost you the patent. It costs you the trade secret, the privilege, or the ability to prove either existed. Two kinds of failure run under everything that follows: a confidentiality failure, where the wrong channel surrenders protection, and a judgment failure, where unexamined output weakens the asset itself. What follows separates the overstated risk (novelty) from the real ones (trade secret, then privilege), the issue that is not about the channel at all (inventorship), and the problem no channel fixes (a bad draft).

AI Prompts Are Not Automatically Prior Art

Section 102(a)(1) makes prior art of certain disclosures before the effective filing date. For AI prompting, the question is usually public accessibility: whether interested, ordinarily skilled persons exercising reasonable diligence could locate the material (In re Hall; GoPro v. Contour, 898 F.3d 1170 (Fed. Cir. 2018)). Disclosure to someone under an obligation of confidentiality does not meet that standard (Cordis v. Boston Scientific), though a confidentiality label will not save material in fact disseminated broadly (Weber v. Provisur).

A prompt submitted through a business, enterprise, or API channel with real confidentiality, no-training, and retention limits is not indexed, searchable, or locatable. Retention by a provider is not publication to the world, and no ordinary Section 102 event follows from the prompt alone.

Two contrary arguments circulate, and neither survives that standard. The first is technical: that the model splices a non-enabling fragment of your input into its training data and serves a complete, enabling description to the next user. But that argument skips the public-accessibility requirement. Even if a model surfaced fragments of one input to another user, a single private exchange that no interested person can search for or locate is not a public disclosure, and no Section 102 event follows from it. The second is legal: that once a provider’s terms permit retention or training, the input has left any sphere of secrecy and is therefore public. That conflates disclosure to a bound party with disclosure to the public. A provider operating under its own terms is a party under obligation, which is the opposite of public accessibility – and a prompt held in its systems is locatable by no one. Losing a confidentiality posture and publishing to the world are different acts; only the second is a Section 102 event.

One caveat heads off the obvious objection. The on-sale bar is a separate path: Helsinn v. Teva holds that even a confidential sale can put an invention “on sale.” But a prompt is not a sale or an offer for sale, so Helsinn marks the boundary by analogy without governing prompting.

Patent Novelty is Usually Not the Worst Risk

On a controlled channel, novelty is intact. On a consumer or individual tier whose terms permit training, broad retention, human review, or disclosure without meaningful confidentiality commitments, be precise about what breaks. Training on your input does not, by itself, make it publicly accessible; the world still cannot retrieve your specific prompt. The immediate damage from an uncontrolled consumer channel is usually not novelty but loss of secrecy. Novelty is threatened only where the input becomes publicly retrievable, or where foreign rights are in play. That last point has teeth: the U.S. grace period under Section 102(b)(1)(A) can absorb an inadvertent domestic slip, but it does not travel. Europe applies strict novelty with no general inventor grace period, so a lapse curable here is unrecoverable at the EPO.

There is one channel where that retrievability is not hypothetical. Public model-evaluation arenas, where users compare two anonymous models and vote, generally condition use on terms that grant the operator the right to release the conversation. The operator of the LMSYS Chatbot Arena obtained that consent and then published the LMSYS-Chat-1M dataset, roughly one million real user conversations, downloadable on public repositories today. A prompt entered there is not held in a vendor’s protected systems; it is released to the public by design, the kind of accessible reference the standard reaches. This is not a counterexample to the channel analysis. It is the cleanest proof of it. The consequence followed not from the involvement of AI but from the terms, which authorized publication, and the operator, which acted on them. Frontier products under standard or enterprise terms commit to the opposite. Same tool category, opposite terms, opposite result.

The Real Asset-Destruction Risk: Trade Secrets

The patent may survive. The trade secret may not.

A trade secret exists only so long as its owner takes reasonable measures to keep it secret, and disclosure to a party under no confidentiality obligation extinguishes it (Ruckelshaus v. Monsanto). A patent issues with a statutory presumption of validity under Section 282, and the challenger carries the burden. A trade secret carries no presumption: the owner must prove it existed and was kept secret, and a single uncontrolled disclosure can defeat that showing. There is no patent-style grace period, no one-year window, and often no practical cure once secrecy is lost. The wrong AI channel is not just a lapse; it is a permanent bad fact for the “reasonable measures” element you will later have to prove.

Privilege and Work Product: Same Rules, Different Facts

This is where the panic pieces overreach. The doctrine has not changed; three early-2026 federal decisions reached different results on different facts, and they split on the question that matters most: how much the terms of the channel decide. In United States v. Heppner, 2026 WL 436479 (S.D.N.Y. Feb. 17, 2026), Judge Rakoff held that a criminal defendant’s self-directed exchanges with a consumer version of Claude were neither privileged nor work product – the tool was not a lawyer or a lawyer’s agent, the consumer terms permitted training and disclosure to the government, and the defendant acted on his own rather than at counsel’s direction. None of that turned on AI; it turned on the absence of a lawyer in the loop and the terms of the channel. Two civil courts went the other way – Warner v. Gilbarco, 2026 WL 373043 (E.D. Mich. Feb. 10, 2026), and Morgan v. V2X, 2026 WL 864223 (D. Colo. Mar. 30, 2026) – holding a pro se litigant’s AI-assisted materials were work product, since work product is waived only by disclosure to an adversary and an AI tool is an instrument, not one. Morgan went further, holding that routing data through an intermediary does not by itself extinguish confidentiality.

The divergence is the whole story. These decisions apply ordinary principles to different relationships, postures, and channel terms; they do not create an AI-specific waiver rule. Client self-help on a consumer channel is exposed, counsel-directed use of a controlled tool is stronger, and which one you are in turns first on the relationship and the purpose. Morgan even wrote those conditions into a protective order – no training on inputs, no nonessential retention – a concrete checklist to hold a tool against, though it is one court’s order, not a general rule. The channel decides the confidentiality element, not whether a lawyer or a legal-advice purpose exists at all.

The Developing Variable: The Specific Model

As of June 2026, the channel includes not just the tier but the specific model, because a model can carry its own data-handling terms. Anthropic’s short-lived Fable/Mythos rollout was the live example: per its support materials, prompts and outputs for those models were retained for 30 days on every platform that offered them, with no zero-retention option, even inside enterprise organizations that had negotiated exactly that. The model did not override an enterprise’s zero-retention terms; it could not run under them. The retention was for safety rather than training, but for confidentiality analysis the operative fact is simpler: the material was retained and could not be treated as non-retained. And confidentiality was not the end of it – within days Anthropic suspended the models entirely, under a Commerce Department directive reportedly grounded in export-control authorities, a reminder that the specific model can govern whether a tool is available at all, not just how it handles data. None of this is settled; model-specific terms may become a trend or stay a one-off. But it is already a live diligence item. “Are we on enterprise?” no longer ends the inquiry – the specific model now belongs in the channel audit, not just the tier.

Two Things the Channel Cannot Fix

Get the channel perfect and two risks remain, because neither was ever about the channel.

The first is inventorship. On November 28, 2025, the U.S. Patent and Trademark Office (USPTO) rescinded its February 2024 inventorship guidance for AI-assisted inventions. The 2024 version had stretched the Pannu joint-inventorship factors to cover a single human working with AI; the revision withdrew that and restored the ordinary conception test. Only a natural person can be an inventor (Thaler v. Vidal); AI is a tool. The danger is not that AI assistance makes inventorship defective. It is that fluent AI output can stand in for the conception it only imitates, so the human who accepted it gets named as the inventor of an idea the model supplied. The Office presumes the named inventors are correct and will not catch the error unless the record makes it plain; the defect may surface later, as a validity or enforceability problem. Document genuine human conception against the claims.

The second is draft quality, which turns not on confidentiality but on judgment. A frontier model that has read every case on claim-limiting language and estoppel will still hand you “the present invention is” phrasing that reads as a limitation, a specification that claims more than it supports under Section 112, or a response that narrows a claim term into prosecution-history estoppel. None of that trips a confidentiality rule or reads as error on the page. The channel protects confidentiality. It does not protect patent asset quality. Only review and professional judgment does.

The Channel Audit

Before client material touches any tool, a practitioner should be able to answer:

• Is the invention already filed, or still confidential and unfiled?
• Is the tool consumer, paid-individual, enterprise, API, or private deployment, and what do its terms permit the provider to do with the input?
• Are inputs used for training, retained (for how long, and where), or reviewable by a human?
• Does this specific model carry a retention, review, or routing condition the tier does not?
• Have you preserved contemporaneous proof: the operative terms, model page, retention setting, admin configuration, and date of use? A trade secret or privilege fight two years later turns on the record, not on memory.
• Where does the output go, and can confidential input become public through careless downstream use?

Competence Now Means Knowing the Tool, Not Trusting It

The competent response is not to ban the tools or wave off the risks. It is to size each one, and the two that matter most run on different duties. On confidentiality, the questions are which tool, which tier, which model, which terms, and whether you could prove the choice later – the duty to protect the client’s confidences (Model Rule 1.6; 37 C.F.R. 11.106), now extended to the tools you pour them into. On quality, the rule is older and blunter: every paper is your responsibility under 37 C.F.R. 11.18(b), and the tool’s fluent output is not a substitute for your own reasonable inquiry. You cannot certify what you did not verify.

AI does not create a new patent panic category. It exposes two ordinary professional failures that AI makes easier to miss. One is a confidentiality failure: the wrong channel can surrender a trade secret or waive protection before any patent question is reached. The other is a judgment failure: unexamined output can leave you with the wrong inventor, unsupported claims, narrowing language, or prosecution positions that later shrink the asset. Those are different problems. One turns on the channel that carried the information; the other turns on whether the practitioner actually did the legal and technical work. The patent still issues. That is not the same as preserving the value around it or the strength inside it. AI does not decide that. Counsel does.

Image Source: Deposit Photos
Author: mstanley
Image ID: 122798564