Corgi: The IP Scandal Every S26 Founder Is Ignoring

Miles: Welcome to Year One. I'm Miles, here with Grant, and this one started with a product launch that went sideways inside of 24 hours. Grant: Yeah. The YC-backed insure tech startup Corgi shipped their data room product on June 24th. Within a day, Papermark co-founder Marc Seitz was on X posting side-by-side screenshots. Same feature name, same wording. Word for word. Miles: And Corgi's defense was vibe coding made us do it. Grant: Which raised more questions than it answered. Miles: TechCrunch reported Corgi told them flat out, no code was used from Papermark, but then they also fired off cease and desist letters, one to Seitz, one to a third founder who tweeted a joke about it. Grant: The C&D to the joke guy is the part I can't get past. Miles: Right. So here's what we're getting into today. We talked to an S26 founder who admits they can only explain maybe 60 to 70% of their AI-generated code base. And never ran a license audit before shipping. Grant: Which is Corgi's exact problem scaled down, and we're going to walk through the IP exposure this creates in layers. AGPL strict liability, what the Copyright Office's January 2025 ruling actually means for AI-generated output, the invention assignment gap that quietly derails Series A diligence. Miles: And then we dig into Corgi's legal defense itself – copyright protects expression, not ideas – so independent creation could The second can be a complete answer; but the C and D campaign makes you wonder if they actually believe that. Grant: To market doesn't lie, and neither do the cease and desist letters. Miles: All right: sites posted those screen shots. Corgi's CEO saw the tweet. That's where this thing starts. June 24, Corgi Ships Data Room, a document sharing product for startups doing fundraising due diligence. Standard launch, press release, the whole thing. Then the next morning, Marc Seitz, co-founder of Papermark, posts side-by-side screenshots on X, identical feature language, same UI wording, word-for-word. Grant: And Papermark is AGPL-licensed open source. Of course, so Seitz isn't just saying you copied my vibe, he's calling it copyright infringement. Fraud, actually, was the word he used. Miles: Right, and the screenshots landed because you didn't need to be a developer to see it. Same text, same interface, same everything. It hit Hacker News and X basically simultaneously. Grant: And that's where Corgi CEO Nico Laqua comes in. He posts his own receipts, code comparisons showing the underlying code is different. His argument, stole my enterprise code is a different claim than copied my style. Miles: Which, okay, that's a real legal distinction. TechCrunch reported Corgi told them directly no code was used from Papermark. The spokesperson said the similarities were isolated to visual elements on two peripheral settings pages. Grant: Two peripheral settings pages that happen to be word for word identical. Miles: Yeah, that framing didn't exactly land. Laqua also admitted the team had relied on vibe coding, AI generated the product by describing features in plain language, his words. Grant: So the defense is, the AI did it and what the AI produced looked exactly like Papermark, but technically the code underneath is ours. That's the argument. Miles: That's the argument; and then-this is where it gets strange-Corgi fires cease and desist letters, one to Seitz demanding he took down the tweet, and then one to the founder of Hello World Cafe, a coffee shop that competes with Corgi, because he made a joke about the whole thing. Grant: Wait—a joke? Miles: A joke!" TechCrunch confirmed it, and to a commenter. Grant: I've seen founders panic after a bad news cycle, but you don't see and commenters. That escalates a one day story into a week long story. Miles: I've seen this play out: the instinct is to shut it down fast, but the open source community specifically does not respond well to legal threats. Hundreds of comments, subtweets still going days later. Grant: And Corgi already had a reputation before this. Sued former employees, the CEO's seven days a week podcast comments, this didn't drop into a blank reputation slate. Miles: No, it didn't. So the technical defense might actually hold up, but the question I keep coming back to, if your AI tools produce something that looks exactly like a competitor's AGPL-licensed product, does the legal answer even matter at that point? So Grant: That's the harder question, and I'd bet a lot of S26 founders shipping AI-built products right now haven't thought about it once. Miles: how many of them could actually answer it if an investor asked you? Speaker 3: asked tomorrow. Miles: So let me ask you something direct. If an investor called you tomorrow and walked me through your code base, how much of it could you actually explain line by line? Grant: Yeah, take your time. Miles: No pressure. Honest answer. Grant: Honestly, maybe 60%? 70? The core product logic I understand. The peripheral stuff, the settings pages, some of the UI scaffolding, I'd be guessing on a lot of it. Miles: And that's the part nobody wants to say out loud. 60-70% is probably more self-aware than most founders would admit. I've talked to people who'd say 95 and be lying through their teeth. Grant: Yeah, I mean, the AI moves fast. You're shipping. You're not stopping to audit every component it generates. Miles: Okay, so here's the one I really want to push on. Open-source licenses. When your AI tools were pulling in patterns, referencing existing products, did you ever stop and check what licenses were attached to any of that? Speaker 4: Sure. No, not systematically. We'd check if we were directly copying a repo, but if Claude is just generating something that looks like a Dataroom because we described a data room, no one's running a license audit on the output. Miles: The output. And that's exactly where Corgi ended up. TechCrunch reported the offending features were vibe-coded, the spokesperson confirmed it, and the defense was basically the code is different, we just absorbed the look and language, word for word in some cases. Speaker 4: The Papermark screenshots showed identical feature wording. Same UI copy, same flow. That's not a coincidence. That's what the model had in its context. Miles: Right. So my question to you, if someone did a side-by-side of your product and whatever you prompted the AI to reference, what would that screenshot look like? Speaker 4: I don't know, and that's the honest answer. I don't actually know. Miles: That pause right there is what I keep hearing from founders. Nobody's running that audit until they have to. Speaker 4: And by then, it's Corgi's situation. The valuation on that company hit $2.6 billion. Doesn't matter how good the fundraising story is if the Hacker News thread is calling your code base fraudulent. Miles: I don't know, and that's the honest answer. I don't actually know. That pause right there, that's what I keep hearing. Ballard Spahr attorneys put out a piece on exactly this. The argument is that speed creates hidden exposure. You can build a functioning app in an afternoon, Grant: Yeah. Miles: but the IP questions don't disappear just because you shipped. Speaker 3: And you can't claim ignorance as a defense. The AGPL doesn't care what your AI thought it was doing. Miles: Which brings up the question neither of us can fully answer: the legal exposure. What does no code was copied actually protect you from, and what does it not? Speaker 3: That's the part I want someone to walk us through properly, because I'm not confident I know where the line is. And that's exactly why we brought in someone who does, an IP attorney who works with founders on this specific problem, what your AI built, who owns it, and what liability you're actually carrying into your next fundraise. So flip that around for a second. The founder just told us they can't account for maybe a third of their code base. An IP attorney hears that and has a very specific reaction. Miles: Yeah, and it's not a sympathetic one. The American Bar Association ran a piece on vibe coding and IP. The point they land on is that intent doesn't move the needle on AGPL exposure. If your shipped product incorporates code that triggers the AGPL's requirements, you own that liability. whether or not you knew the AI pulled from a licensed source. Speaker 3: That's the part people don't want to sit with. AGPL is one of the more aggressive open source licenses out there. Under Section 13, running AGPL licensed code in a network accessible service, a web app, a SaaS product, is enough to trigger the copy left obligation. You don't have to distribute a binary, you just have to serve it over HTTPS. Miles: Which is every startup. Speaker 3: Every single one. Miles: And Ballard and Spahr are flagged something in their founder's guide that I keep coming back to: the AI vendors' terms of service—Cursor, clause code, whatever tool you're using-they explicitly disclaim responsibility for copyright infringement in the output. The claim lands on you, not the tool. Speaker 3: I've seen this play out a hundred times in other contexts: the market, or in this case the law, doesn't care how the sausage got made. Miles: Right, and then there's the second layer, which somehow gets less attention. The Copyright Office's Part Two report, out January 2025, confirmed that works created entirely by AI without sufficient human creative control are not eligible for copyright. So you've got a product you can't fully protect and exposure you can't disclaim. Speaker 3: Wait, say that again slowly. You're more vulnerable to someone copying you and more exposed to claims that you copied someone else? Miles: That's the double bind. Your VIBE coded product may sit in a kind of no man's land-hard to register, easy to challenge. Speaker 3: And Ballard's bar raises a third thing that kills Series A deals quietly: invention assignment agreements. If a contractor or early employee wrote material code or the AI tool did under their direction, that IP may not actually belong to the company. Miles: Diligence surfaces that every time. Speaker 3: Every. Time. I've talked to founders who lost term sheets over gaffes like that, not because the product was bad, because the ownership chain was broken. Miles: So the rough picture here: AGPL exposure is strict liability, the WeVive coded in defense doesn't reduce that, your own product may be harder to protect than you think, and a contract gap can detonate the whole thing at A1. Speaker 3: And Corgi is living all four of those simultaneously in public, which sets up a pretty uncomfortable question. Even if they're technically right that no code was copied, does the legal picture actually get cleaner from here? So, Corgi's actual legal defense, on paper, it's not crazy. Miles: Walk me through it. Speaker 3: Copyright protects expression, not ideas. Law recording actually spelled it out pretty clearly: independent creation is a complete defense. If Corgi genuinely wrote its own code and the AI just landed on similar visual patterns, the lookalike screenshots don't automatically mean infringement. Miles: Right, and that's been the law forever. Two people can write songs that sound alike. Without one stealing from the other. Speaker 3: Exactly; so, on paper, we Vibe coded it, the ai produced similar visuals, our underlying code is ours-that's a coherent argument. Miles: Okay, but here's where I get stuck: no lawsuit has been filed as of today, Papermark's options, AGPL enforcement, commercial license demand, litigation-none of that has moved yet. According to Silicon Report, Hacker News observers are describing the resemblance as Speaker 5: '... Miles: As closer to a verbatim copy across whole pages, not just a button colour. Speaker 3: Yeah, the factual question is still completely open; nobody's done a proper audit publicly. Miles: So the defense might be correct or the defense might be a story they're telling because discovery would be ugly. Those are two very different situations. Speaker 3: I've watched founders manage both, and you cannot tell them apart from the outside. Miles: Which is exactly why the cease and desist move. The move is so revealing to me. Speaker 3: Say more. Miles: So if your code is actually clean, you don't need to silence the people talking about it-you publish the audit, you invite the comparison. Sending a cease and desist to a coffee shop founder who cracked a joke on X, that's not a company that's confident. Speaker 3: I'd push back a little. Lawyers sometimes just do that-founders sign off without thinking through how it reads. Miles: Maybe, but Corgi also sent one to Marc Seitz directly. Demanding his original posts come down. TechCrunch confirmed that. That's not a reflex. That's a choice. Speaker 3: Yeah, that one I can't explain away. Seitz made the accusation, the screenshots went viral, trying to erase the original tweet at that point, the post is already everywhere. Miles: Hundreds of comments, countless subtweets, TechCrunch said exactly that. The letter didn't kill the story. It became the story. Speaker 3: Which is the lesson, keep founders, keep relearning. Miles: And this is a company that's previously sued former employees and raised at a $2.6 billion valuation. They have lawyers on speed dial. This wasn't panic. This was posture. Speaker 3: So what does that tell you about whether the defense holds? Miles: Honestly, it tells me the defense might be technically fine and still not matter. The reputational math already ran. Which is actually why the practical stuff in the next segment is worth paying attention to, because founders can't wait for a court to sort this out before they Or they decide how to build. Speaker 3: So practical takeaways: three things founders should be doing before they ship another line of AI-generated code. Miles: Yeah, and I'd argue before Demo Day, not after someone posts a screenshot on X. Speaker 3: First one is the dependency and license scan. Run it now. Ballard Spahr attorneys writing and technically put it plainly, you are the party distributing the output, regardless of what tool generated it. Intent doesn't erase liability. It might reduce damages, but not... Not the claim itself. Miles: And AGPL doesn't care that your AI prompted it into existence. Section 13 fires the moment you serve it over a network. That's strict liability. Grant: So run FOSSA, run a software bill of materials, something. Know what licenses are actually sitting in your repo before an investor's counsel does. Miles: Because they will. Grant: Second one-Invention Assignment Agreements-Every person who touched code, every contractor, every engineer who ran a cursor session for three hours. Miles: I've seen this kill Series A deals quietly. Nobody talks about it because it never makes the press. The product looked great, the numbers looked fine, and diligence just stalled. Grant: Because somebody's missing a signature. Miles: Right, and the founder has no idea why the process suddenly got cold. Grant: Third thing: risk stratification. The Ballard's bar piece frames it well: not every part of your stock carries the same exposure. Figure out which components are customer-facing, which touch regulated data, which would survive a court filing. Those get humanized before they go near production or a data room. Miles: Seriously, that's the framework. Vibe free, verify before merge. You don't need to stop using AI tools. You need to know which outputs get a senior engineer's review and which don't. And which don't. Grant: And Corgi, I mean that's the live case study sitting right in front of every YC S26 founder right now. TechCrunch reported this week the disputed pages were modified and Corgi says no code was taken, but as of today no lawsuit has been filed, no court has ruled, the factual question is still open. Miles: That's the thing that should keep founders up a little. Not just Corgi's outcome specifically, but the fact that Corgi raised a $106 million Series B. Series B one at a two point six billion dollar valuation; and they're still spending founder bandwidth on this. Grant: At that stage, reputation is a real asset; you burn it defending something that a two hour audit might have prevented. Miles: This dispute is still live. Papermark has options. Formal takedown demand, AGPL enforcement litigation. Nobody knows which way it goes. Grant: So if you're on Bookface tonight, this is the conversation worth having. Worth having with your botch; not after the screen shot-before it. Miles: The question isn't whether Vibe coding works-we know it works-the question is whether your data room can survive it. Grant: All right, that's a wrap on Corgi. Miles: Yeah, a C&D to a guy who made a wisecrack on X. That one's going to stick with me. Grant: Same. And honestly, that founder who could only walk through 60, maybe 70% of their own code base? That's the moment this whole thing got real. Miles: Right? Because the legal defense might hold. Independent creation could be a complete answer. But the reputational damage? That's already done. Grant: Run the license scan. Get the invention assignments in order. Know what you actually own before someone else asks. Miles: Concrete. Do it before the AI, not after. Grant: If you know a YC founder in their first year with a story worth telling, send them our way. year1 at heymeadow.com Miles: And if this episode helped you see startups a little differently, leave a review. It matters more than you think. Grant: Thanks for listening. We'll see you next week. Miles: Don't vibe code your way into a C&D. Bye.