AI-generated code copyright explained for builders.
TL; DR
Agentic coding tools like Claude Code, Cursor, and Codex generate code that may be uncopyrightable, owned by your employer, or contaminated by open source licenses you cannot see. Some of this is settled law, some is actively contested, and this piece is clear about which is which. If you are shipping AI-assisted code and have not thought about any of this, this piece is for you.
Legal Layer Angle: In this piece I will talk about what a developer using AI coding tools needs to document to own what they build, what their employment contract probably says about AI-assisted work product, and what the practical implication is for open source contributions written with AI assistance.
If you shipped code this week, some of it was probably written by an AI. The question of who legally owns that code is less settled than most developers assume, and the answer depends on three things that have nothing to do with how good the code is:
whether a human made enough creative decisions to establish copyright,
whether a human made enough creative decisions to establish copyright,
whether your employment contract already assigned it to your employer, and
whether your employment contract already assigned it to your employer, and
whether the model pulled from GPL-licensed training data and quietly contaminated your codebase.
whether the model pulled from GPL-licensed training data and quietly contaminated your codebase.
On March 31, 2026, Anthropic accidentally published 512,000 lines of Claude Code’s source code in a routine software update through a missing configuration file. Before sunrise, the codebase was mirrored across GitHub. Before breakfast, a developer had used an AI tool to rewrite the entire thing in Python, and the “claw-code” repository hit 100,000 GitHub stars in a single day, the fastest in history. Then came the DMCA takedowns, and then came the question nobody had a clean answer to:
If Claude Code was, by Anthropic’s own lead engineer’s admission, predominantly written by Claude itself, does Anthropic even own it? Can you issue a DMCA takedown for code that copyright law may not protect?
If Claude Code was, by Anthropic’s own lead engineer’s admission, predominantly written by Claude itself, does Anthropic even own it? Can you issue a DMCA takedown for code that copyright law may not protect?
That incident compressed every open question about AI-generated code ownership into a single news cycle. The same questions apply to your codebase.
AI-generated code copyright explained for builders.
TL; DR
Agentic coding tools like Claude Code, Cursor, and Codex generate code that may be uncopyrightable, owned by your employer, or contaminated by open source licenses you cannot see. Some of this is settled law, some is actively contested, and this piece is clear about which is which. If you are shipping AI-assisted code and have not thought about any of this, this piece is for you.
Legal Layer Angle: In this piece I will talk about what a developer using AI coding tools needs to document to own what they build, what their employment contract probably says about AI-assisted work product, and what the practical implication is for open source contributions written with AI assistance.
The copyright rule nobody told you
Here is the legal baseline, in plain terms: copyright only protects work created by a human.
The US Copyright Office has confirmed this consistently, and the DC Circuit upheld it in the Thaler case. When the Supreme Court declined to hear the Thaler appeal in March 2026, it did not endorse the lower court's reasoning or settle the question nationally. Cert denial means the Court chose not to hear the case, nothing more. What it does mean is that the DC Circuit's ruling stands, the Copyright Office's position is intact, and no court has yet gone the other way. Works predominantly generated by AI without meaningful human authorship are not eligible for copyright protection under current doctrine, and that position is stable even if it is not finally settled.
Two important limits on what Thaler actually decided.
The case involved a painting created with zero human involvement at all. Thaler listed the AI system as sole author and made no claim of any human creative contribution. The ruling does not directly address the harder question of AI-assisted work where a human was involved but the degree of that involvement is disputed.
The case involved a painting created with zero human involvement at all. Thaler listed the AI system as sole author and made no claim of any human creative contribution. The ruling does not directly address the harder question of AI-assisted work where a human was involved but the degree of that involvement is disputed.
Thaler involved visual art. No court has yet applied the human authorship doctrine specifically to code output from an AI coding tool. The logic applies, but the direct precedent does not exist yet.
Thaler involved visual art. No court has yet applied the human authorship doctrine specifically to code output from an AI coding tool. The logic applies, but the direct precedent does not exist yet.
What it means for you:
Code that Claude Code or Cursor generated and you accepted without meaningful modification may not be copyrightable by anyone. If a competitor copies it, you may have no legal recourse, because the code sits in the public domain in everything but name.
The phrase that determines whether your code is protected is “meaningful human authorship,” and the Copyright Office has deliberately refused to quantify it with a percentage or a number of edits, because what courts look for is evidence that a human made genuine creative decisions:
choosing the architecture,
choosing the architecture,
deciding what to reject,
deciding what to reject,
restructuring the output to fit a specific design.
restructuring the output to fit a specific design.
Specifying an objective to the model is not enough. Directing how the work is constructed is what counts.
In an agentic workflow, this distinction is harder to establish than it sounds. Consider a typical Claude Code session:
You write a one-line prompt: “build a rate limiting module for the API”
You write a one-line prompt: “build a rate limiting module for the API”
Claude Code plans the approach, generates five files, and iterates through three versions
Claude Code plans the approach, generates five files, and iterates through three versions
You review the output, run the tests, and merge
You review the output, run the tests, and merge
Your contribution in that sequence is your architectural intent and your final approval. Whether that constitutes meaningful human authorship in a courtroom is an unresolved question with no definitive court ruling yet.
The honest answer is: probably yes for modules you substantially redirected, probably no for code you accepted verbatim, and unclear for everything in between.
The middle ground is actively being litigated right now. In Allen v. Perlmutter, artist Jason Allen is challenging the Copyright Office’s denial of registration for a work he created using more than 600 detailed prompts and subsequent editing in Photoshop. The Copyright Office acknowledged the Photoshop edits as human-authored but still denied registration for the AI-generated underlying elements. That case has not been decided yet, and whatever it decides will be the closest thing to a ruling on how much human involvement is enough.
The closest existing precedent on partial protection is Zarya of the Dawn, a graphic novel where the Copyright Office granted registration for the human-authored text but denied it for the Midjourney-generated images. That decision establishes a practical principle developers can use right now: the human-authored elements of an AI-assisted codebase may be separately protectable even if the generated code itself is not. Your architecture documents, your design decisions recorded in commit messages, your ADRs, your prompt logs showing deliberate redirection, these may be protectable as human-authored expression even if the code they produced is not. Protecting what you can starts with documenting what you actually did.
What your employer probably already owns
Before you think about whether your code is copyrightable, there is a more immediate question: even if it is, is it actually yours?
Your employment contract almost certainly says that anything you build at work belongs to your employer. That principle has a name in copyright law: the work-for-hire doctrine. Under it, any code created by an employee within the scope of their employment is owned by the employer, who is treated as the legal author, regardless of whether the code was written by hand, generated by Claude Code, or some combination. Using an AI coding tool during work hours, on a work project, on a work machine, does not change who owns the result.
Most employment contracts go further than the doctrine’s defaults. Look for a section in yours called “Intellectual Property,” “IP Assignment,” or “Work Product.” Open the contract, search for those terms, and read that section. A clause that says any of the following almost certainly covers your AI-assisted code:
“any work product created using company equipment or resources”
“any work product created using company equipment or resources”
“any invention or development made during the term of employment”
“any invention or development made during the term of employment”
“any software created with the assistance of company-licensed tools”
“any software created with the assistance of company-licensed tools”
The third one is the one to watch. If your employer licenses Claude Code, Cursor, or Copilot for the team, and you use those same tools to build a side project, a broad IP assignment clause may give the employer a claim over that project, even if you built it on your own time.
A senior developer in San Francisco described exactly this situation earlier this year. He had used Claude Code for work projects and for a personal fitness tracking app built on evenings and weekends. His company updated its IP policy and claimed everything he had built with AI assistance, including the personal app, arguing that because Claude had access to open work files in the IDE, any AI output was a derivative work of company IP.
This is the clearest example of how far this can stretch. His company's claim rested on one phrase: the AI tools were "context-aware" of his company's codebase. The argument does not hold up legally, because context visibility in an IDE does not make AI output a derivative work of files that were open nearby, and the connection between what Claude can see and what it generates is probabilistic pattern completion, not copying. But the argument illustrates what employers are starting to claim. If the clause is broad enough, it has surface validity regardless of what the AI actually did.
The practical rule: if you are building something on the side, use a personal account, a personal machine, and tools you pay for yourself. Keep your employer’s licensed tools out of that workflow entirely.
The open source contamination problem
Even if you own your AI-generated code, you may have already contaminated it with an open source license you cannot see.
AI coding tools are trained on massive amounts of public code, including code licensed under the GPL, LGPL, and other copyleft licenses. Copyleft licenses carry a specific obligation that travels with the code:
If you distribute software that is a derivative of GPL-licensed code, you must release your own source code under the same license
If you distribute software that is a derivative of GPL-licensed code, you must release your own source code under the same license
This applies even if you did not know the code you incorporated was GPL-licensed
This applies even if you did not know the code you incorporated was GPL-licensed
“I did not know” is not a defense to a copyleft violation
“I did not know” is not a defense to a copyleft violation
🚨 When an AI tool reproduces a substantial verbatim portion of GPL-licensed code from its training data, and you ship that code in a commercial product without releasing source, you may have created a copyleft violation without ever touching the original repository. The legal standard for infringement is substantial verbatim reproduction, not functional similarity or resemblance, and this distinction matters: an AI tool generating code that works like GPL code is different from an AI tool that reproduces GPL code word for word. The risk sits at the verbatim end of that spectrum, and the problem is that you have no way to know which side of the line your codebase is on without running a scan.
The chardet community dispute made this concrete in early 2026. This was not a filed lawsuit but a public dispute within the open source community that raised the question without resolving it legally. A developer used Claude to rewrite chardet, a Python character encoding library, and re-released it under an MIT license, arguing that the AI rewrite was a “clean room” implementation free of the original LGPL license.
The legal question the community fought over: if Claude was trained on the LGPL-licensed codebase and its output reproduces substantial verbatim portions of that code, can the output be treated as license-free? The chardet dispute did not resolve cleanly and no court has issued a definitive ruling on this specific question. What is settled is that verbatim copying of GPL code violates the license regardless of how it was produced. What is unsettled is whether AI-generated output that reproduces training data patterns counts as verbatim copying. The working assumption among lawyers advising companies through M&A is that it probably does, and that assumption is now showing up as a standard condition in acquisition due diligence.
The Doe v GitHub litigation, still working through the Ninth Circuit as of April 2026, is asking whether GitHub Copilot reproduces licensed code without attribution in violation of copyright law and DMCA Section 1202. The district court dismissed most claims but the appeal is live. Whatever the outcome, the litigation has already changed industry behavior: GitHub Copilot added duplicate detection filters, and acquisition due diligence now routinely includes an AI codebase license scan.
What to do about all of this
Four concrete actions, none of which require a lawyer.
Run a license scan on your AI-assisted codebase
Tools that do this well:
FOSSA — most comprehensive, widely used in enterprise
FOSSA — most comprehensive, widely used in enterprise
Snyk Open Source — good for dev-team workflows, integrates with GitHub
Snyk Open Source — good for dev-team workflows, integrates with GitHub
Black Duck — standard in M&A due diligence
Black Duck — standard in M&A due diligence
Each will scan your codebase, flag code that matches known open source libraries, and identify the licenses attached. If you are shipping a commercial product and have never run one of these, you are operating on assumption. The scan takes an afternoon and costs less than the first hour of a copyright dispute.
Document your human creative contributions as you go
The evidence that establishes meaningful human authorship is the same evidence you already produce in a normal engineering workflow. You just have to keep it deliberately rather than letting it disappear.
What to preserve:
Commit messages that describe what you changed and why, not just what the AI generated. “Restructured Claude’s module architecture, rejected initial state management approach, rewrote error handling from scratch” is evidence. “Add rate limiting module” is not.
Commit messages that describe what you changed and why, not just what the AI generated. “Restructured Claude’s module architecture, rejected initial state management approach, rewrote error handling from scratch” is evidence. “Add rate limiting module” is not.
Prompt logs. Claude Code and Cursor both retain interaction history. Export or screenshot the sessions where you made significant architectural decisions.
Prompt logs. Claude Code and Cursor both retain interaction history. Export or screenshot the sessions where you made significant architectural decisions.
Design documents, ADRs, or any notes that predate the generated code and show you specified the structure before the AI built it.
Design documents, ADRs, or any notes that predate the generated code and show you specified the structure before the AI built it.
The second commit message versus the first is the difference between a defensible authorship claim and a clean “Claude wrote this” record.
Read the IP clause in your employment contract before you build anything on the side
Open your contract, search for “intellectual property,” “IP assignment,” or “work product,” and read that section carefully. The specific language determines your exposure:
“Work product created during employment hours” is narrower than “work product created using company resources”
“Work product created during employment hours” is narrower than “work product created using company resources”
“Relating to the company’s business” is narrower than “any software development”
“Relating to the company’s business” is narrower than “any software development”
“Company-licensed tools” is the phrase that captures AI coding tools even on personal projects
“Company-licensed tools” is the phrase that captures AI coding tools even on personal projects
If the clause is broad and you want to build something independently, you have three realistic options: negotiate a written carveout before you start (easier at the start of a new role than mid-employment), use entirely personal tools on entirely personal time on a personal machine, or accept that the claim exists and decide whether the risk is worth it.
Check which Anthropic plan you are on before shipping for commercial use
Go to anthropic.com/legal and compare the consumer terms against the commercial terms. The difference that matters:
Consumer terms (free and Pro plans): Anthropic assigns outputs to you, but the IP indemnification is narrower and covers fewer scenarios.
Consumer terms (free and Pro plans): Anthropic assigns outputs to you, but the IP indemnification is narrower and covers fewer scenarios.
Commercial terms (API and enterprise): Anthropic assigns outputs to you and will defend you against copyright infringement claims arising from your authorized use of the service and its outputs.
Commercial terms (API and enterprise): Anthropic assigns outputs to you and will defend you against copyright infringement claims arising from your authorized use of the service and its outputs.
If you are shipping AI-assisted code in a commercial product using the free or Pro plan, the indemnification gap is real. The API or enterprise agreement is the appropriate tier. Note that neither indemnification covers a downstream GPL violation from license contamination in your codebase. That is your governance problem to solve with the license scan in action 1.
The thing worth sitting with
Anthropic’s own lead engineer publicly stated that his recent contributions to Claude Code were written entirely by the AI, and the leaked codebase that Anthropic issued 8,000 DMCA takedowns to suppress may be predominantly AI-authored. Whether Anthropic’s copyright claims over that codebase are legally valid remains an open question no court has yet resolved.
If the company that built the tool cannot cleanly assert copyright over its own AI-assisted code, the question of whether you can is worth taking seriously before it becomes relevant in a transaction, a dispute, or an acquisition conversation. The developer who documents their creative contributions from the start is in a meaningfully different legal position than the one who accepted three thousand lines of Claude output and merged without review, even if both shipped the same product.
A note on what this piece covers and what it does not.
Three things in it are settled law:
works lacking human authorship are uncopyrightable,
works lacking human authorship are uncopyrightable,
the work-for-hire doctrine applies regardless of how code was generated, and
the work-for-hire doctrine applies regardless of how code was generated, and
verbatim copying of GPL-licensed code violates the license.
verbatim copying of GPL-licensed code violates the license.
Two things are emerging consensus without definitive court rulings yet:
how much human direction is enough to establish meaningful authorship in an agentic workflow, and
how much human direction is enough to establish meaningful authorship in an agentic workflow, and
whether AI output that reproduces training data patterns counts as verbatim copying.
whether AI output that reproduces training data patterns counts as verbatim copying.
One thing is genuine speculation:
whether any of this will be litigated at scale in the near term.
whether any of this will be litigated at scale in the near term.
Most code copyright claims never reach court. The place where the unsettled questions become concrete today is M&A due diligence and institutional fundraising, where acquirers and investors are already asking these questions as a condition of closing.
If neither of those applies to your situation right now, the four actions above are still worth doing, but the urgency is lower than the piece might imply.
Further reading
US Copyright Office — Copyright and Artificial Intelligence (Part 2: Copyrightability)
The primary regulatory source on what qualifies as meaningful human authorship in AI-assisted works. Part 2 covers the specific tests the Office applies when reviewing AI-generated content registrations. Essential if you want to understand exactly where the legal line sits.
Andersen v. Stability AI, Midjourney, DeviantArt — Ninth Circuit docket
The foundational case on AI training data and copyright infringement, currently shaping how courts think about what AI models learn and reproduce. Relevant to the GPL contamination question in a way most developers have not connected yet.
Doe v. GitHub, Inc. — Ninth Circuit appeal
The live litigation on whether Copilot reproduces licensed code without attribution. Track this one: the Ninth Circuit decision will set the standard that determines whether AI-generated code carrying open source patterns constitutes copyright infringement.
GitHub — Copilot and copyright: what you need to know
GitHub’s own legal position on why Copilot outputs are not infringing. Worth reading as a counterpoint: understanding the argument they make helps you understand where it is strong and where it has limits, particularly on the GPL training data question.
FOSSA — Understanding open source license obligations
A developer-friendly reference to how copyleft obligations actually work in practice: what triggers the source disclosure requirement, what constitutes a derivative work, and how the GPL, LGPL, and AGPL differ in their reach. The clearest plain-language guide available on this topic.
Anthropic — Usage Policy and Terms of Service
The actual document that determines your IP rights and indemnification scope when you use Claude commercially. Read sections 7 and 8 specifically: output ownership and IP indemnification. The difference between the consumer and commercial terms is stated plainly and takes ten minutes to understand.
I write about legal architecture for AI products at Legal Layer. This piece is informational and does not constitute legal advice.
If you shipped code this week, some of it was probably written by an AI. The question of who legally owns that code is less settled than most developers assume, and the answer depends on three things that have nothing to do with how good the code is:
whether a human made enough creative decisions to establish copyright,
whether a human made enough creative decisions to establish copyright,
whether your employment contract already assigned it to your employer, and
whether your employment contract already assigned it to your employer, and
whether the model pulled from GPL-licensed training data and quietly contaminated your codebase.
whether the model pulled from GPL-licensed training data and quietly contaminated your codebase.
On March 31, 2026, Anthropic accidentally published 512,000 lines of Claude Code’s source code in a routine software update through a missing configuration file. Before sunrise, the codebase was mirrored across GitHub. Before breakfast, a developer had used an AI tool to rewrite the entire thing in Python, and the “claw-code” repository hit 100,000 GitHub stars in a single day, the fastest in history. Then came the DMCA takedowns, and then came the question nobody had a clean answer to:
If Claude Code was, by Anthropic’s own lead engineer’s admission, predominantly written by Claude itself, does Anthropic even own it? Can you issue a DMCA takedown for code that copyright law may not protect?
If Claude Code was, by Anthropic’s own lead engineer’s admission, predominantly written by Claude itself, does Anthropic even own it? Can you issue a DMCA takedown for code that copyright law may not protect?
That incident compressed every open question about AI-generated code ownership into a single news cycle. The same questions apply to your codebase.
The copyright rule nobody told you
Here is the legal baseline, in plain terms: copyright only protects work created by a human.
The US Copyright Office has confirmed this consistently, and the DC Circuit upheld it in the Thaler case. When the Supreme Court declined to hear the Thaler appeal in March 2026, it did not endorse the lower court's reasoning or settle the question nationally. Cert denial means the Court chose not to hear the case, nothing more. What it does mean is that the DC Circuit's ruling stands, the Copyright Office's position is intact, and no court has yet gone the other way. Works predominantly generated by AI without meaningful human authorship are not eligible for copyright protection under current doctrine, and that position is stable even if it is not finally settled.
Two important limits on what Thaler actually decided.
The case involved a painting created with zero human involvement at all. Thaler listed the AI system as sole author and made no claim of any human creative contribution. The ruling does not directly address the harder question of AI-assisted work where a human was involved but the degree of that involvement is disputed.
The case involved a painting created with zero human involvement at all. Thaler listed the AI system as sole author and made no claim of any human creative contribution. The ruling does not directly address the harder question of AI-assisted work where a human was involved but the degree of that involvement is disputed.
Thaler involved visual art. No court has yet applied the human authorship doctrine specifically to code output from an AI coding tool. The logic applies, but the direct precedent does not exist yet.
Thaler involved visual art. No court has yet applied the human authorship doctrine specifically to code output from an AI coding tool. The logic applies, but the direct precedent does not exist yet.
What it means for you:
Code that Claude Code or Cursor generated and you accepted without meaningful modification may not be copyrightable by anyone. If a competitor copies it, you may have no legal recourse, because the code sits in the public domain in everything but name.
The phrase that determines whether your code is protected is “meaningful human authorship,” and the Copyright Office has deliberately refused to quantify it with a percentage or a number of edits, because what courts look for is evidence that a human made genuine creative decisions:
choosing the architecture,
choosing the architecture,
deciding what to reject,
deciding what to reject,
restructuring the output to fit a specific design.
restructuring the output to fit a specific design.
Specifying an objective to the model is not enough. Directing how the work is constructed is what counts.
In an agentic workflow, this distinction is harder to establish than it sounds. Consider a typical Claude Code session:
You write a one-line prompt: “build a rate limiting module for the API”
You write a one-line prompt: “build a rate limiting module for the API”
Claude Code plans the approach, generates five files, and iterates through three versions
Claude Code plans the approach, generates five files, and iterates through three versions
You review the output, run the tests, and merge
You review the output, run the tests, and merge
Your contribution in that sequence is your architectural intent and your final approval. Whether that constitutes meaningful human authorship in a courtroom is an unresolved question with no definitive court ruling yet.
The honest answer is: probably yes for modules you substantially redirected, probably no for code you accepted verbatim, and unclear for everything in between.
The middle ground is actively being litigated right now. In Allen v. Perlmutter, artist Jason Allen is challenging the Copyright Office’s denial of registration for a work he created using more than 600 detailed prompts and subsequent editing in Photoshop. The Copyright Office acknowledged the Photoshop edits as human-authored but still denied registration for the AI-generated underlying elements. That case has not been decided yet, and whatever it decides will be the closest thing to a ruling on how much human involvement is enough.
The closest existing precedent on partial protection is Zarya of the Dawn, a graphic novel where the Copyright Office granted registration for the human-authored text but denied it for the Midjourney-generated images. That decision establishes a practical principle developers can use right now: the human-authored elements of an AI-assisted codebase may be separately protectable even if the generated code itself is not. Your architecture documents, your design decisions recorded in commit messages, your ADRs, your prompt logs showing deliberate redirection, these may be protectable as human-authored expression even if the code they produced is not. Protecting what you can starts with documenting what you actually did.
What your employer probably already owns
Before you think about whether your code is copyrightable, there is a more immediate question: even if it is, is it actually yours?
Your employment contract almost certainly says that anything you build at work belongs to your employer. That principle has a name in copyright law: the work-for-hire doctrine. Under it, any code created by an employee within the scope of their employment is owned by the employer, who is treated as the legal author, regardless of whether the code was written by hand, generated by Claude Code, or some combination. Using an AI coding tool during work hours, on a work project, on a work machine, does not change who owns the result.
Most employment contracts go further than the doctrine’s defaults. Look for a section in yours called “Intellectual Property,” “IP Assignment,” or “Work Product.” Open the contract, search for those terms, and read that section. A clause that says any of the following almost certainly covers your AI-assisted code:
“any work product created using company equipment or resources”
“any work product created using company equipment or resources”
“any invention or development made during the term of employment”
“any invention or development made during the term of employment”
“any software created with the assistance of company-licensed tools”
“any software created with the assistance of company-licensed tools”
The third one is the one to watch. If your employer licenses Claude Code, Cursor, or Copilot for the team, and you use those same tools to build a side project, a broad IP assignment clause may give the employer a claim over that project, even if you built it on your own time.
A senior developer in San Francisco described exactly this situation earlier this year. He had used Claude Code for work projects and for a personal fitness tracking app built on evenings and weekends. His company updated its IP policy and claimed everything he had built with AI assistance, including the personal app, arguing that because Claude had access to open work files in the IDE, any AI output was a derivative work of company IP.
This is the clearest example of how far this can stretch. His company's claim rested on one phrase: the AI tools were "context-aware" of his company's codebase. The argument does not hold up legally, because context visibility in an IDE does not make AI output a derivative work of files that were open nearby, and the connection between what Claude can see and what it generates is probabilistic pattern completion, not copying. But the argument illustrates what employers are starting to claim. If the clause is broad enough, it has surface validity regardless of what the AI actually did.
The practical rule: if you are building something on the side, use a personal account, a personal machine, and tools you pay for yourself. Keep your employer’s licensed tools out of that workflow entirely.
The open source contamination problem
Even if you own your AI-generated code, you may have already contaminated it with an open source license you cannot see.
AI coding tools are trained on massive amounts of public code, including code licensed under the GPL, LGPL, and other copyleft licenses. Copyleft licenses carry a specific obligation that travels with the code:
If you distribute software that is a derivative of GPL-licensed code, you must release your own source code under the same license
If you distribute software that is a derivative of GPL-licensed code, you must release your own source code under the same license
This applies even if you did not know the code you incorporated was GPL-licensed
This applies even if you did not know the code you incorporated was GPL-licensed
“I did not know” is not a defense to a copyleft violation
“I did not know” is not a defense to a copyleft violation
🚨 When an AI tool reproduces a substantial verbatim portion of GPL-licensed code from its training data, and you ship that code in a commercial product without releasing source, you may have created a copyleft violation without ever touching the original repository. The legal standard for infringement is substantial verbatim reproduction, not functional similarity or resemblance, and this distinction matters: an AI tool generating code that works like GPL code is different from an AI tool that reproduces GPL code word for word. The risk sits at the verbatim end of that spectrum, and the problem is that you have no way to know which side of the line your codebase is on without running a scan.
The chardet community dispute made this concrete in early 2026. This was not a filed lawsuit but a public dispute within the open source community that raised the question without resolving it legally. A developer used Claude to rewrite chardet, a Python character encoding library, and re-released it under an MIT license, arguing that the AI rewrite was a “clean room” implementation free of the original LGPL license.
The legal question the community fought over: if Claude was trained on the LGPL-licensed codebase and its output reproduces substantial verbatim portions of that code, can the output be treated as license-free? The chardet dispute did not resolve cleanly and no court has issued a definitive ruling on this specific question. What is settled is that verbatim copying of GPL code violates the license regardless of how it was produced. What is unsettled is whether AI-generated output that reproduces training data patterns counts as verbatim copying. The working assumption among lawyers advising companies through M&A is that it probably does, and that assumption is now showing up as a standard condition in acquisition due diligence.
The Doe v GitHub litigation, still working through the Ninth Circuit as of April 2026, is asking whether GitHub Copilot reproduces licensed code without attribution in violation of copyright law and DMCA Section 1202. The district court dismissed most claims but the appeal is live. Whatever the outcome, the litigation has already changed industry behavior: GitHub Copilot added duplicate detection filters, and acquisition due diligence now routinely includes an AI codebase license scan.
What to do about all of this
Four concrete actions, none of which require a lawyer.
Run a license scan on your AI-assisted codebase
Tools that do this well:
FOSSA — most comprehensive, widely used in enterprise
FOSSA — most comprehensive, widely used in enterprise
Snyk Open Source — good for dev-team workflows, integrates with GitHub
Snyk Open Source — good for dev-team workflows, integrates with GitHub
Black Duck — standard in M&A due diligence
Black Duck — standard in M&A due diligence
Each will scan your codebase, flag code that matches known open source libraries, and identify the licenses attached. If you are shipping a commercial product and have never run one of these, you are operating on assumption. The scan takes an afternoon and costs less than the first hour of a copyright dispute.
Document your human creative contributions as you go
The evidence that establishes meaningful human authorship is the same evidence you already produce in a normal engineering workflow. You just have to keep it deliberately rather than letting it disappear.
What to preserve:
Commit messages that describe what you changed and why, not just what the AI generated. “Restructured Claude’s module architecture, rejected initial state management approach, rewrote error handling from scratch” is evidence. “Add rate limiting module” is not.
Commit messages that describe what you changed and why, not just what the AI generated. “Restructured Claude’s module architecture, rejected initial state management approach, rewrote error handling from scratch” is evidence. “Add rate limiting module” is not.
Prompt logs. Claude Code and Cursor both retain interaction history. Export or screenshot the sessions where you made significant architectural decisions.
Prompt logs. Claude Code and Cursor both retain interaction history. Export or screenshot the sessions where you made significant architectural decisions.
Design documents, ADRs, or any notes that predate the generated code and show you specified the structure before the AI built it.
Design documents, ADRs, or any notes that predate the generated code and show you specified the structure before the AI built it.
The second commit message versus the first is the difference between a defensible authorship claim and a clean “Claude wrote this” record.
Read the IP clause in your employment contract before you build anything on the side
Open your contract, search for “intellectual property,” “IP assignment,” or “work product,” and read that section carefully. The specific language determines your exposure:
“Work product created during employment hours” is narrower than “work product created using company resources”
“Work product created during employment hours” is narrower than “work product created using company resources”
“Relating to the company’s business” is narrower than “any software development”
“Relating to the company’s business” is narrower than “any software development”
“Company-licensed tools” is the phrase that captures AI coding tools even on personal projects
“Company-licensed tools” is the phrase that captures AI coding tools even on personal projects
If the clause is broad and you want to build something independently, you have three realistic options: negotiate a written carveout before you start (easier at the start of a new role than mid-employment), use entirely personal tools on entirely personal time on a personal machine, or accept that the claim exists and decide whether the risk is worth it.
Check which Anthropic plan you are on before shipping for commercial use
Go to anthropic.com/legal and compare the consumer terms against the commercial terms. The difference that matters:
Consumer terms (free and Pro plans): Anthropic assigns outputs to you, but the IP indemnification is narrower and covers fewer scenarios.
Consumer terms (free and Pro plans): Anthropic assigns outputs to you, but the IP indemnification is narrower and covers fewer scenarios.
Commercial terms (API and enterprise): Anthropic assigns outputs to you and will defend you against copyright infringement claims arising from your authorized use of the service and its outputs.
Commercial terms (API and enterprise): Anthropic assigns outputs to you and will defend you against copyright infringement claims arising from your authorized use of the service and its outputs.
If you are shipping AI-assisted code in a commercial product using the free or Pro plan, the indemnification gap is real. The API or enterprise agreement is the appropriate tier. Note that neither indemnification covers a downstream GPL violation from license contamination in your codebase. That is your governance problem to solve with the license scan in action 1.
The thing worth sitting with
Anthropic’s own lead engineer publicly stated that his recent contributions to Claude Code were written entirely by the AI, and the leaked codebase that Anthropic issued 8,000 DMCA takedowns to suppress may be predominantly AI-authored. Whether Anthropic’s copyright claims over that codebase are legally valid remains an open question no court has yet resolved.
If the company that built the tool cannot cleanly assert copyright over its own AI-assisted code, the question of whether you can is worth taking seriously before it becomes relevant in a transaction, a dispute, or an acquisition conversation. The developer who documents their creative contributions from the start is in a meaningfully different legal position than the one who accepted three thousand lines of Claude output and merged without review, even if both shipped the same product.
A note on what this piece covers and what it does not.
Three things in it are settled law:
works lacking human authorship are uncopyrightable,
works lacking human authorship are uncopyrightable,
the work-for-hire doctrine applies regardless of how code was generated, and
the work-for-hire doctrine applies regardless of how code was generated, and
verbatim copying of GPL-licensed code violates the license.
verbatim copying of GPL-licensed code violates the license.
Two things are emerging consensus without definitive court rulings yet:
how much human direction is enough to establish meaningful authorship in an agentic workflow, and
how much human direction is enough to establish meaningful authorship in an agentic workflow, and
whether AI output that reproduces training data patterns counts as verbatim copying.
whether AI output that reproduces training data patterns counts as verbatim copying.
One thing is genuine speculation:
whether any of this will be litigated at scale in the near term.
whether any of this will be litigated at scale in the near term.
Most code copyright claims never reach court. The place where the unsettled questions become concrete today is M&A due diligence and institutional fundraising, where acquirers and investors are already asking these questions as a condition of closing.
If neither of those applies to your situation right now, the four actions above are still worth doing, but the urgency is lower than the piece might imply.
Further reading
US Copyright Office — Copyright and Artificial Intelligence (Part 2: Copyrightability)
The primary regulatory source on what qualifies as meaningful human authorship in AI-assisted works. Part 2 covers the specific tests the Office applies when reviewing AI-generated content registrations. Essential if you want to understand exactly where the legal line sits.
Andersen v. Stability AI, Midjourney, DeviantArt — Ninth Circuit docket
The foundational case on AI training data and copyright infringement, currently shaping how courts think about what AI models learn and reproduce. Relevant to the GPL contamination question in a way most developers have not connected yet.
Doe v. GitHub, Inc. — Ninth Circuit appeal
The live litigation on whether Copilot reproduces licensed code without attribution. Track this one: the Ninth Circuit decision will set the standard that determines whether AI-generated code carrying open source patterns constitutes copyright infringement.
GitHub — Copilot and copyright: what you need to know
GitHub’s own legal position on why Copilot outputs are not infringing. Worth reading as a counterpoint: understanding the argument they make helps you understand where it is strong and where it has limits, particularly on the GPL training data question.
FOSSA — Understanding open source license obligations
A developer-friendly reference to how copyleft obligations actually work in practice: what triggers the source disclosure requirement, what constitutes a derivative work, and how the GPL, LGPL, and AGPL differ in their reach. The clearest plain-language guide available on this topic.
Anthropic — Usage Policy and Terms of Service
The actual document that determines your IP rights and indemnification scope when you use Claude commercially. Read sections 7 and 8 specifically: output ownership and IP indemnification. The difference between the consumer and commercial terms is stated plainly and takes ten minutes to understand.
I write about legal architecture for AI products at Legal Layer. This piece is informational and does not constitute legal advice.