Your Moat Just Got Vibe-Coded: IP Protection in the Age of AI Clones
By: Moish Peltz
Earlier this month, a developer in Atlanta released free, AI-built versions of seven Adobe Creative Cloud apps, including a Photoshop look-alike called PhotoCraft. A few months before that, a frustrated small business owner used Claude Code to build SlowBooks Pro, a free replacement for QuickBooks. Neither are polished, enterprise-grade products. But both show how far vibe coding has come, and both raise a question every software and SaaS company should be asking: if someone can rebuild your product's functionality with an AI coding agent, without copying your code, can intellectual property law stop them?
The honest answer is "less than you might think." Copyright, patent, trade secret and trademark law each leave a gap that a careful clone can slip through. Contract terms are probably the strongest tool left, but they have real limits too. And because no court has yet applied these doctrines to AI-generated software, much of this remains unsettled. But courts move slowly, and AI moves at the speed of a prompt, so the next clone is already shipping while the law is catching up.
What is Vibe Coding?
Vibe coding is building software by describing what you want to an AI coding agent and iterating on the results, often without reading much of the code it writes. Andrej Karpathy coined the term in February 2025, and in less than two years it has gone from a weekend novelty to a way of producing credible substitutes for commercial software. Wall Street has noticed: worries that customers will build their own tools instead of paying for subscriptions helped drive a 2026 sell-off in software stocks that the press nicknamed the "SaaSpocalypse."
Vibe-Coded Clones of Photoshop, QuickBooks, and More
The most talked-about example is ArtCraft. In early October, an Atlanta-based developer released open-source apps modeled on Photoshop, Illustrator, Premiere, Lightroom, Acrobat Pro, After Effects and InDesign, which he says he built in Rust using Anthropic's Claude. He describes them as early-alpha "clean-room reimplementations" based on public specifications and observed behavior rather than Adobe's code.
SlowBooks Pro has a more personal origin story. Its developer ran QuickBooks 2003 Pro for 14 years, until a hard drive failed and the software couldn't be reinstalled because Intuit had shut down its activation servers. So he built his own replacement with Claude Code. Today it handles double-entry bookkeeping, invoicing, payroll and inventory, imports QuickBooks data through Intuit's IIF interchange format, and syncs with QuickBooks Online. The project says no Intuit source code was used and that it was built from Intuit's published SDK documentation and years of experience as a customer. Early versions of the code, however, carried tongue-in-cheek "decompilation" comments referencing QuickBooks program internals, which the developer describes as invented fiction and has since removed.
Copyright Protects Code, Not What the Code Does
Copyright is usually the first tool software companies reach for, and it's the one a well-built clone most directly avoids. Copyright protects original expression, not the ideas, systems or methods of operation behind it (17 U.S.C. § 102(b)). A competitor that writes new code to achieve the same results hasn't infringed on that basis alone.
Recent decisions point the same way. In SAS Institute v. World Programming (Fed. Cir. 2023), World Programming had built a competing analytics platform that runs programs written in SAS's own programming language. SAS sued for copyright infringement and lost, because it failed to show which elements of its software were actually protectable once functional and unprotectable elements were filtered out. In Google v. Oracle (2021), the Supreme Court held that Google's reuse of Java's API declarations, which let programmers carry familiar commands into a new platform, was fair use. A clone that reads QuickBooks or Photoshop files sits comfortably within that line of cases.
That doesn't make copyright irrelevant. Icons, artwork, templates and help text are protectable, and infringement still turns on whether anything was actually copied. This is where AI makes things interesting. Traditional clean-room development kept the engineers who studied the original separate from those who wrote the new code, creating a clear record of independent creation. With AI, that record gets murkier. What if the model was trained on related code, or was handed the original as input? And how will a court read a codebase that, even as a joke, describes itself as decompiled from the original? No court has yet decided whether an AI-assisted process qualifies as a legitimate clean room. There's also a twist: after Thaler v. Perlmutter (D.C. Cir. 2025; cert. denied 2026), code generated entirely by AI may not be copyrightable at all, which could leave both the clone and parts of the incumbent's own codebase unprotected.
Patents Are Narrower, but Independent Creation Is No Defense
Since Alice Corp. v. CLS Bank (2014), courts have regularly invalidated patents on abstract software business concepts, so a company usually can't patent the general idea of its product. But patents claiming specific technical improvements can survive, and unlike copyright, patent infringement doesn't require copying. If a clone practices a valid claim, a clean-room process won't save it. Design patents, which protect the ornamental look of interface elements like icons and screen layouts, may be especially useful against clones whose main selling point is looking familiar. The catch is cost and speed, particularly against a free open-source project.
Trade Secret Law Allows Reverse Engineering
The Defend Trade Secrets Act expressly says that reverse engineering and independent derivation are not "improper means" (18 U.S.C. § 1839(6)(B)). Features and workflows every customer can see aren't secrets, so a clone built by watching how a product works, or by reading published documentation, isn't misappropriating anything. Trade secrets still matter for server-side SaaS logic users never see, and they become very real when the copier had confidential access. That's the theory in Runlayer's lawsuit against Rippling, Anysource, Inc. v. People Center, Inc. (S.D.N.Y., filed July 2026), which alleges that Rippling used access from a confidential partnership to "build essentially a clone." Those are only allegations. Rippling has called the claims meritless and filed its own patent suit against Runlayer, and the case doesn't involve vibe coding. But it shows where the law has the most traction.
Trademark and Trade Dress
Trademark law protects brands, not products. A clone sold under its own name doesn't infringe just by competing, and using a competitor's mark to describe compatibility ("imports QuickBooks files") or to make truthful comparisons is generally allowed. Names like PhotoCraft and SlowBooks are obvious nods to the originals, which raises a fair question about how close a name can get before it suggests affiliation. Trade dress is another possible theory for an interface that mimics the original, but it requires secondary meaning and excludes functional features (Wal-Mart v. Samara, 2000; TrafFix Devices v. Marketing Displays, 2001). Here's the tension: a clone marketed as instantly familiar is showing deliberate imitation, but it's also making the case that the familiar layout is functional. And bold claims about feature parity are factual statements; if they're false, they could support a Lanham Act false advertising claim.
Contract Terms: The Strongest Lever, and the Least Settled
If IP law leaves gaps, contracts may fill some of them. Many end user license agreements and SaaS terms of service prohibit reverse engineering, and some go further and bar customers from using the product to build a competing one. The SAS saga shows how much those terms can matter. In a separate case, the Fourth Circuit affirmed that World Programming breached the license for SAS's Learning Edition software, which prohibited reverse engineering and limited use to non-production purposes (SAS Institute v. World Programming, 4th Cir. 2017). SAS's copyright claims over its software went nowhere, but the jury awarded about $26 million for the breach, and related fraud and unfair trade practices findings pushed the judgment to roughly $79 million. Even so, the court refused an injunction, and a U.K. court applying EU software law had declined to enforce the same contract restrictions.
But contract protection has limits. Courts disagree about when the Copyright Act preempts contract claims that effectively protect what copyright leaves free. The Second Circuit found a terms-based claim preempted in ML Genius v. Google (2022, summary order), and the Supreme Court declined to review it in 2023. A California federal court went further and applied conflict preemption to anti-scraping terms in X Corp. v. Bright Data (N.D. Cal. 2024), and reaffirmed that ruling later that year before the case settled in 2025 without an appeal. A contract also binds only the people who agreed to it, so a developer working from public documentation, or the users of an open-source fork, may never have accepted anything. That raises a new question: if an AI agent clicks "I agree" while exploring a product, is the person who deployed it bound? Overly aggressive anti-competition clauses can also invite a copyright misuse defense, which the Fourth Circuit recognized in Lasercomb v. Reynolds (1990) for a license that barred licensees from developing competing software for 99 years. And after Van Buren v. United States (2021), misusing a system you're authorized to access, such as by breaking its terms of use, generally isn't a federal computer crime. In practice, contracts work best against identifiable competitors who were once customers or partners, and worst against an anonymous developer posting code on GitHub.
Has Anyone Sued Over a Vibe-Coded Clone?
Not yet, as far as we can tell. Press reports through October 11, 2026 found no lawsuit or cease-and-desist letter from Adobe over ArtCraft, and we found no reports of action by Intuit against SlowBooks Pro. That isn't surprising. These projects are mostly free and run by individuals, so there's little to recover and a real risk of public backlash, and incumbents may be wary of testing an untried theory and ending up with a bad precedent. Still, silence isn't consent, and claims can come well after the headlines fade.
Questions the Courts Will Need to Answer
When the first case is filed, courts will face questions existing precedent doesn't squarely answer. Can an AI-assisted process qualify as a legal clean room? Do contractual bans on building a competing product survive copyright preemption? Is someone bound by terms their AI agent accepted? Is a familiar interface protectable trade dress or unprotectable function? And what, if anything, does anyone own in AI-generated code?
Practical Steps for Software Companies and Developers
For software and SaaS companies, now is a good time to review your EULAs and terms of service for reverse-engineering, competitive-use and AI agent access provisions, and to make sure users accept them through an enforceable clickwrap flow. It's also worth mapping your utility and design patents to the features a clone would most likely copy, keeping your most valuable logic on the server side, and registering copyrights in icons, artwork and documentation.
For developers building alternatives, the same principles apply in reverse. Don't feed the original's source code, binaries or assets into your AI tools, and keep records of how you built the product. Avoid copying visual design, use the incumbent's trademarks only to describe compatibility, and read the terms you've already agreed to. And as SlowBooks shows, be careful with jokes in your code comments or on social media: a tribute today could look a lot like evidence in a courtroom tomorrow.
The law has always let competitors build products that do the same thing, as long as they don't copy protected expression, infringe a valid patent or break a promise. Vibe coding hasn't changed those rules, but it has changed how cheaply and quickly they can be tested. We expect the courts to start weighing in this area sooner rather than later.
If you have questions regarding protections for your software or AI-generated code, contact FRB today to schedule a consultation with an experienced Intellectual Property or Artificial Intelligence lawyer.
DISCLAIMER: This summary is not legal advice and does not create any attorney-client relationship. This summary does not provide a definitive legal opinion for any factual situation. Before the firm can provide legal advice or opinion to any person or entity, the specific facts at issue must be reviewed by the firm. Before an attorney-client relationship is formed, the firm must have a signed engagement letter with a client setting forth the Firm’s scope and terms of representation. The information contained herein is based upon the law at the time of publication.