In 2015, I was the Chief Security Officer of a semiconductor company, and the FBI briefed me on an active operation. A chip had been found on a server board, a chip that was not supposed to be there, calling home to China. Not to the manufacturer. To China. The agents were direct: this was not a one-off. It was impacting thousands of servers.

Six years later I went on record about it with Bloomberg Businessweek, one of three executives willing to be named in a story that more than fifty others declined to comment on. I mention this not for the war story, but to establish the baseline. Semiconductor IP is the most patiently, professionally targeted intellectual property on earth. The adversaries are state-backed, the campaigns run for years, and export controls have only sharpened the motivation: covert acquisition is the commercial deal that could not close.

Which is why what is happening right now inside fabs and design houses deserves more attention than it gets.

The new exfiltration path is voluntary

For decades, stealing a process recipe required compromising a network or a person. In 2026, it can require nothing more than your best process engineer trying to be productive on a Tuesday.

An engineer pastes a section of a process recipe into a public chatbot to debug a yield excursion. A designer uploads a timing report to get help interpreting it. A test engineer asks a free AI tool to refactor a program that embeds proprietary test vectors. No malice anywhere, quite the opposite: your most valuable people are precisely the ones most likely to reach for AI leverage. But every one of those prompts now sits in an external provider's logs, outside your security boundary, governed by terms of service your counsel never reviewed, potentially eligible for model training.

The crown jewels do not need to be stolen if they are being volunteered.

Why the ban reflex fails

The instinctive response, blocking the chatbots at the proxy, is the one I watched fail from the CISO chair. Bans do not stop usage; they relocate it to personal phones and home laptops, where you have zero visibility. You get all of the leakage and none of the telemetry. Worse, a ban tells your engineers that the security organization is where productivity goes to die, which poisons the next ten controls you actually need them to follow.

The companies getting this right treat AI enablement as a security program with a product mindset: make the sanctioned path more convenient than the shadow path, and instrument it.

The enablement program that works

  1. Classify data for AI, not just for storage. Your existing data classification says who can read a document. It now needs a second axis: which AI tier may process it. Process recipes, design files, test vectors, and yield data sit in the most restricted tier. No public models, period.
  2. Stand up a sanctioned tier engineers actually want. Enterprise model endpoints with contractual no-training guarantees, tenant isolation, and regional pinning, wired into the tools engineers already use. The measure of success is adoption, not policy sign-off.
  3. Gate by context, not by blanket rule. The same engineer legitimately needs AI on public datasheets and must never point it at a recipe. Controls need to distinguish the two, through data-boundary enforcement at the endpoint and egress monitoring tuned to what recipe-shaped content looks like leaving.
  4. Treat model hosting as an export-control question. Under EAR, controlled technical data processed by a model hosted in the wrong jurisdiction is an export. Your AI tooling decisions are now trade-compliance decisions, and the fine print about where inference runs matters as much as any feature.
  5. Give the program a carrot: knowledge capture. The same secure infrastructure that protects recipes can preserve them, through structured capture of retiring process engineers' expertise into an internal, access-controlled AI knowledge base. That single use case has funded more than one enablement program on its own.

The board framing

Ten years ago, the briefing I gave boards was about implants arriving on boards from the supply chain. The threat did not wait for policy then, and it is not waiting now. The AI version of the briefing is simpler: our IP now has a new way to leave the building, our engineers are the ones carrying it out innocently, and the fix is not to slow them down but to give them a faster path that we control and can see.

Second-tier suppliers should take note especially. If you make components, integrate systems, or run test services inside someone else's supply chain, you carry this exposure without the prime contractor's security budget. You are also exactly where sophisticated adversaries go first.