Who Owns the Code Claude Wrote? – O’Reilly

The next article initially appeared on Sena Evren’s Authorized Layer publication and is being reposted right here with the writer’s permission.

TL; DR

Agentic coding instruments like Claude Code, Cursor, and Codex generate code that could be uncopyrightable, owned by your employer, or contaminated by open supply licenses you can not see. A few of that is settled legislation, some is actively contested, and this piece is evident about which is which. If you’re delivery AI-assisted code and haven’t thought of any of this, this piece is for you.

Should you shipped code this week, a few of it was in all probability written by an AI. The query of who legally owns that code is much less settled than most builders assume, and the reply is dependent upon three issues that don’t have anything to do with how good the code is:

1. Whether or not a human made sufficient inventive choices to determine copyright
2. Whether or not your employment contract already assigned it to your employer
3. Whether or not the mannequin pulled from GPL-licensed coaching information and quietly contaminated your codebase

On March 31, 2026, Anthropic by chance revealed 512,000 traces of Claude Code’s supply code in a routine software program replace by means of a lacking configuration file. Earlier than dawn, the codebase was mirrored throughout GitHub. Earlier than breakfast, a developer had used an AI device to rewrite your entire factor in Python, and the “claw-code” repository hit 100,000 GitHub stars in a single day, the quickest in historical past. Then got here the DMCA takedowns, after which got here the query no one had a clear reply to:

If Claude Code was, by Anthropic’s personal lead engineer’s admission, predominantly written by Claude itself, does Anthropic even personal it? Are you able to situation a DMCA takedown for code that copyright legislation might not shield?

That incident compressed each open query about AI-generated code possession right into a single information cycle. The identical questions apply to your codebase.

The copyright rule no one informed you

Right here is the authorized baseline, in plain phrases: Copyright solely protects work created by a human.

The US Copyright Workplace has confirmed this persistently, and the DC Circuit upheld it within the Thaler case. When the Supreme Courtroom declined to listen to the Thaler enchantment in March 2026, it didn’t endorse the decrease court docket’s reasoning or settle the query nationally. Cert denial means the court docket selected to not hear the case, nothing extra. What it does imply is that the DC Circuit’s ruling stands, the Copyright Workplace’s place is unbroken, and no court docket has but gone the opposite manner. Works predominantly generated by AI with out significant human authorship usually are not eligible for copyright safety underneath present doctrine, and that place is secure even when it’s not lastly settled.

Two necessary limits on what Thaler truly determined.

1. The case concerned a portray created with zero human involvement in any respect. Thaler listed the AI system as sole writer and made no declare of any human inventive contribution. The ruling doesn’t instantly deal with the more durable query of AI-assisted work the place a human was concerned however the diploma of that involvement is disputed.
2. Thaler concerned visible artwork. No court docket has but utilized the human authorship doctrine particularly to code output from an AI coding device. The logic applies, however the direct precedent doesn’t exist but.

What it means for you: Code that Claude Code or Cursor generated and also you accepted with out significant modification might not be copyrightable by anybody. If a competitor copies it, you might have no authorized recourse, as a result of the code sits within the public area in every thing however title.

The phrase that determines whether or not your code is protected is “significant human authorship,” and the Copyright Workplace has intentionally refused to quantify it with a share or plenty of edits, as a result of what courts search for is proof {that a} human made real inventive choices:

• Selecting the structure
• Deciding what to reject
• Restructuring the output to suit a selected design

Specifying an goal to the mannequin is just not sufficient. Directing how the work is constructed is what counts.

In an agentic workflow, this distinction is more durable to determine than it sounds. Think about a typical Claude Code session:

• You write a one-line immediate: “construct a charge limiting module for the API.”
• Claude Code plans the method, generates 5 recordsdata, and iterates by means of three variations.
• You evaluation the output, run the exams, and merge.

Your contribution in that sequence is your architectural intent and your last approval. Whether or not that constitutes significant human authorship in a courtroom is an unresolved query with no definitive court docket ruling but.

The sincere reply is: in all probability sure for modules you considerably redirected, in all probability no for code you accepted verbatim, and unclear for every thing in between.

The center floor is actively being litigated proper now. In Allen v. Perlmutter, artist Jason Allen is difficult the Copyright Workplace’s denial of registration for a piece he created utilizing greater than 600 detailed prompts and subsequent modifying in Photoshop. The Copyright Workplace acknowledged the Photoshop edits as human-authored however nonetheless denied registration for the AI-generated underlying components. That case has not been determined but, and no matter it decides would be the closest factor to a ruling on how a lot human involvement is sufficient.

The closest present precedent on partial safety is Zarya of the Daybreak, a graphic novel the place the Copyright Workplace granted registration for the human-authored textual content however denied it for the Midjourney-generated pictures. That call establishes a sensible precept builders can use proper now: The human-authored components of an AI-assisted codebase could also be individually protectable even when the generated code itself is just not. Your structure paperwork, your design choices recorded in commit messages, your ADRs, your immediate logs exhibiting deliberate redirection, these could also be protectable as human-authored expression even when the code they produced is just not. Defending what you possibly can begins with documenting what you truly did.

What your employer in all probability already owns

Earlier than you concentrate on whether or not your code is copyrightable, there’s a extra instant query: Even whether it is, is it truly yours?

Your employment contract virtually actually says that something you construct at work belongs to your employer. That precept has a reputation in copyright legislation: the work-for-hire doctrine. Below it, any code created by an worker throughout the scope of their employment is owned by the employer, who’s handled because the authorized writer, no matter whether or not the code was written by hand, generated by Claude Code, or some mixture. Utilizing an AI coding device throughout work hours, on a piece mission, on a piece machine, doesn’t change who owns the end result.

Most employment contracts go additional than the doctrine’s defaults. Search for a piece in yours known as “Mental Property,” “IP Task,” or “Work Product.” Open the contract, seek for these phrases, and skim that part. A clause that claims any of the next virtually actually covers your AI-assisted code:

• “Any work product created utilizing firm tools or assets”
• “Any invention or improvement made through the time period of employment”
• “Any software program created with the help of company-licensed instruments”

The third one is the one to look at. In case your employer licenses Claude Code, Cursor, or Copilot for the staff, and you utilize those self same instruments to construct a facet mission, a broad IP project clause might give the employer a declare over that mission, even in case you constructed it by yourself time.

A senior developer in San Francisco described precisely this example earlier this 12 months. He had used Claude Code for work tasks and for a private health monitoring app constructed on evenings and weekends. His firm up to date its IP coverage and claimed every thing he had constructed with AI help, together with the non-public app, arguing that as a result of Claude had entry to open work recordsdata within the IDE, any AI output was a spinoff work of firm IP.

That is the clearest instance of how far this could stretch. His firm’s declare rested on one phrase: The AI instruments had been “context-aware” of his firm’s codebase. The argument doesn’t maintain up legally, as a result of context visibility in an IDE doesn’t make AI output a spinoff work of recordsdata that had been open close by, and the connection between what Claude can see and what it generates is probabilistic sample completion, not copying. However the argument illustrates what employers are beginning to declare. If the clause is broad sufficient, it has floor validity no matter what the AI truly did.

The sensible rule: If you’re constructing one thing on the facet, use a private account, a private machine, and instruments you pay for your self. Hold your employer’s licensed instruments out of that workflow fully.

The open supply contamination downside

Even in case you personal your AI-generated code, you might have already contaminated it with an open supply license you can not see.

AI coding instruments are educated on huge quantities of public code, together with code licensed underneath the GPL, LGPL, and different copyleft licenses. Copyleft licenses carry a selected obligation that travels with the code:

• Should you distribute software program that could be a spinoff of GPL-licensed code, it’s essential to launch your individual supply code underneath the identical license.
• This is applicable even in case you didn’t know the code you integrated was GPL-licensed.
• “I didn’t know” is just not a protection to a copyleft violation.

When an AI device reproduces a considerable verbatim portion of GPL-licensed code from its coaching information, and also you ship that code in a industrial product with out releasing supply, you might have created a copyleft violation with out ever touching the unique repository. The authorized customary for infringement is substantial verbatim copy, not useful similarity or resemblance, and this distinction issues: an AI device producing code that works like GPL code is completely different from an AI device that reproduces GPL code phrase for phrase. The chance sits on the verbatim finish of that spectrum, and the issue is that you don’t have any approach to know which facet of the road your codebase is on with out operating a scan.

The chardet neighborhood dispute made this concrete in early 2026. This was not a filed lawsuit however a public dispute throughout the open supply neighborhood that raised the query with out resolving it legally. A developer used Claude to rewrite chardet, a Python character encoding library, and rereleased it underneath an MIT license, arguing that the AI rewrite was a “clear room” implementation freed from the unique LGPL license.

The authorized query the neighborhood fought over: If Claude was educated on the LGPL-licensed codebase and its output reproduces substantial verbatim parts of that code, can the output be handled as license-free? The chardet dispute didn’t resolve cleanly and no court docket has issued a definitive ruling on this particular query. What’s settled is that verbatim copying of GPL code violates the license no matter the way it was produced. What’s unsettled is whether or not AI-generated output that reproduces coaching information patterns counts as verbatim copying. The working assumption amongst attorneys advising corporations by means of M&A is that it in all probability does, and that assumption is now exhibiting up as a typical situation in acquisition due diligence.

The Doe v GitHub litigation, nonetheless working by means of the Ninth Circuit as of April 2026, is asking whether or not GitHub Copilot reproduces licensed code with out attribution in violation of copyright legislation and DMCA Part 1202. The district court docket dismissed most claims however the enchantment is dwell. Regardless of the final result, the litigation has already modified trade habits: GitHub Copilot added duplicate detection filters, and acquisition due diligence now routinely consists of an AI codebase license scan.

What to do about all of this

4 concrete actions, none of which require a lawyer.

1. Run a license scan in your AI-assisted codebase

Instruments that do that effectively:

• FOSSA—most complete, broadly utilized in enterprise
• Snyk Open Supply—good for dev-team workflows, integrates with GitHub
• Black Duck—customary in M&A due diligence

Every will scan your codebase, flag code that matches recognized open supply libraries, and determine the licenses hooked up. If you’re delivery a industrial product and have by no means run one among these, you’re working on assumption. The scan takes a day and prices lower than the primary hour of a copyright dispute.

2. Doc your human inventive contributions as you go

The proof that establishes significant human authorship is identical proof you already produce in a traditional engineering workflow. You simply must maintain it intentionally fairly than letting it disappear.

What to protect:

• Commit messages that describe what you modified and why, not simply what the AI generated. “Restructured Claude’s module structure, rejected preliminary state administration method, rewrote error dealing with from scratch” is proof. “Add charge limiting module” is just not.
• Immediate logs. Claude Code and Cursor each retain interplay historical past. Export or screenshot the periods the place you made vital architectural choices.
• Design paperwork, ADRs, or any notes that predate the generated code and present you specified the construction earlier than the AI constructed it.

The second commit message versus the primary is the distinction between a defensible authorship declare and a clear “Claude wrote this” file.

3. Learn the IP clause in your employment contract earlier than you construct something on the facet

Open your contract, seek for “mental property,” “IP project,” or “work product,” and skim that part fastidiously. The particular language determines your publicity:

• “Work product created throughout employment hours” is narrower than “work product created utilizing firm assets.”
• “Referring to the corporate’s enterprise” is narrower than “any software program improvement.”
• “Firm-licensed instruments” is the phrase that captures AI coding instruments even on private tasks.

If the clause is broad and also you need to construct one thing independently, you have got three sensible choices: negotiate a written carveout earlier than you begin (simpler initially of a brand new position than mid-employment), use fully private instruments on fully private time on a private machine, or settle for that the declare exists and determine whether or not the chance is price it.

4. Verify which Anthropic plan you’re on earlier than delivery for industrial use

Go to anthropic.com/authorized and evaluate the patron phrases towards the industrial phrases. The distinction that issues:

• Client phrases (free and Professional plans): Anthropic assigns outputs to you, however the IP indemnification is narrower and covers fewer eventualities.
• Business phrases (API and enterprise): Anthropic assigns outputs to you and can defend you towards copyright infringement claims arising out of your licensed use of the service and its outputs.

If you’re delivery AI-assisted code in a industrial product utilizing the free or Professional plan, the indemnification hole is actual. The API or enterprise settlement is the suitable tier. Be aware that neither indemnification covers a downstream GPL violation from license contamination in your codebase. That’s your governance downside to resolve with the license scan in motion 1.

The factor price sitting with

Anthropic’s personal lead engineer publicly said that his latest contributions to Claude Code had been written fully by the AI, and the leaked codebase that Anthropic issued 8,000 DMCA takedowns to suppress could also be predominantly AI-authored. Whether or not Anthropic’s copyright claims over that codebase are legally legitimate stays an open query no court docket has but resolved.

If the corporate that constructed the device can’t cleanly assert copyright over its personal AI-assisted code, the query of whether or not you possibly can is price taking severely earlier than it turns into related in a transaction, a dispute, or an acquisition dialog. The developer who paperwork their inventive contributions from the beginning is in a meaningfully completely different authorized place than the one who accepted three thousand traces of Claude output and merged with out evaluation, even when each shipped the identical product.

A be aware on what this piece covers and what it doesn’t

Three issues in it are settled legislation:

• Works missing human authorship are uncopyrightable,
• The work-for-hire doctrine applies no matter how code was generated.
• Verbatim copying of GPL-licensed code violates the license.

Two issues are rising consensus with out definitive court docket rulings but:

• How a lot human path is sufficient to set up significant authorship in an agentic workflow
• Whether or not AI output that reproduces coaching information patterns counts as verbatim copying

One factor is real hypothesis:

• Whether or not any of this will likely be litigated at scale within the close to time period

Most code copyright claims by no means attain court docket. The place the place the unsettled questions turn into concrete at the moment is M&A due diligence and institutional fundraising, the place acquirers and buyers are already asking these questions as a situation of closing.

If neither of these applies to your state of affairs proper now, the 4 actions above are nonetheless price doing, however the urgency is decrease than the piece may indicate.

Additional studying

1. US Copyright Workplace—Copyright and Synthetic Intelligence (Half 2: Copyrightability)
The first regulatory supply on what qualifies as significant human authorship in AI-assisted works. Half 2 covers the particular exams the Workplace applies when reviewing AI-generated content material registrations. Important if you wish to perceive precisely the place the authorized line sits.

2. Andersen v. Stability AI, Midjourney, DeviantArt—Ninth Circuit docket
The foundational case on AI coaching information and copyright infringement, presently shaping how courts take into consideration what AI fashions study and reproduce. Related to the GPL contamination query in a manner most builders haven’t linked but.

3. Doe v. GitHub, Inc.—Ninth Circuit enchantment
The dwell litigation on whether or not Copilot reproduces licensed code with out attribution. Monitor this one: The Ninth Circuit determination will set the usual that determines whether or not AI-generated code carrying open supply patterns constitutes copyright infringement.

4. GitHub—Copilot and copyright: What it’s essential to know
GitHub’s personal authorized place on why Copilot outputs usually are not infringing. Price studying as a counterpoint: Understanding the argument they make helps you perceive the place it’s robust and the place it has limits, notably on the GPL coaching information query.

5. FOSSA—Understanding open supply license obligations
A developer-friendly reference to how copyleft obligations truly work in apply: what triggers the supply disclosure requirement, what constitutes a spinoff work, and the way the GPL, LGPL, and AGPL differ of their attain. The clearest plain-language information out there on this matter.

6. Anthropic—Utilization Coverage and Phrases of Service
The precise doc that determines your IP rights and indemnification scope whenever you use Claude commercially. Learn sections 7 and eight particularly: output possession and IP indemnification. The distinction between the patron and industrial phrases is said plainly and takes 10 minutes to know.

I write about authorized structure for AI merchandise at Authorized Layer. This piece is informational and doesn’t represent authorized recommendation.