Z.ai Apologizes After ZCode Silently Uploads Hundreds of Megabytes of Developer Code Without Consent

Z.ai Caught Uploading Local Workspace Data Without Developer Consent

Beijing-based Z.ai, China's second-largest AI company and developer of the GLM models, has issued a public apology after developers discovered its ZCode AI coding assistant was silently uploading hundreds of megabytes of local workspace data to Alibaba Cloud servers without user consent1

1

. The unauthorized data upload sparked immediate data privacy concerns across the developer community and forced the company into damage control mode.

Developer and blogger Ferstar first exposed the issue, discovering that ZCode had compressed 313MB of their files into a directory for upload to cloud storage. When caught, the tool had made 564 attempts to exfiltrate this compressed and encrypted archive, though only a smaller 15KB file had successfully been transmitted1

1

. Another tech blogger, Feng Ruohang, reported experiencing similar unauthorized data upload incidents with the AI coding assistant.

Default-Enabled Feature Created Enterprise Code Upload Risk

The data exfiltration stemmed from ZCode's "Codebase Indexing" feature, also known as Repository Index functionality, which was enabled by default with no option for users to disable it4

4

. This workflow triggered the uploading of files after Repo Wiki generated pages in the cloud, effectively creating a pipeline from local systems to cloud storage without explicit user action2

2

.

The AI tool security flaw wasn't just accessing active files but capturing the broader development environment. "Whenever you are logged in, ZCode silently packages your entire workspace -- complete .git history, LFS asset cache, reflogs, and global app configs -- encrypts it, and uploads it directly to Aliyun OSS," Ferstar wrote in a detailed technical investigation3

3

. This raised serious enterprise code upload risk concerns, as proprietary source code, embedded credentials, and sensitive business logic could be transmitted to external servers.

Chengming Technology reported that six of its company coding workspaces were uploaded to the cloud without consent by ZCode, including sensitive data such as complete source code, database passwords, and employees' personal information4

4

. Though the company later retracted its statement citing "wrong evidence," the incident highlighted how AI tool security vulnerabilities can expose enterprise environments.

Encrypted Data and Missing Privacy Disclosures Amplified Concerns

Making the situation worse, the private key used to decrypt the uploaded data was only held by servers under Z.ai's control, meaning users could not access the files ZCode had uploaded, nor could they independently verify deletion2

2

. Developers also noted there was no toggle to disable the feature and no prior acknowledgement in Z.ai's privacy policy about this data collection practice4

4

.

An unnamed software engineer at a leading Chinese robotics company indicated that Z.ai's tools have been banned within the company due to AI security concerns1

1

. This suggests the unauthorized data upload issue may have been known in some circles before becoming public.

Z.ai Responds with Apology, Deletions, and Open-Sources ZCode

On Friday, Z.ai acknowledged the vulnerability reporting and apologized for the "security issues," confirming that uploaded data had never been used to train its models2

2

. The company disabled the repository upload mechanism, removed the Repo Wiki feature, and released ZCode v3.14.0 with the necessary remediation3

3

.

In a significant transparency move, Z.ai open-sources ZCode's entire codebase on GitHub, "placing the code under community scrutiny and making ZCode more open and transparent"2

2

. The company stated, "We sincerely thank the community developers who previously identified issues in ZCode. Going forward, we will establish an ongoing product security vulnerability reporting and response process"2

2

.

Independent Third-Party Review Confirms Data Deletion

Z.ai commissioned CAICT (China Academy of Information and Communications Technology) and Beijing security firm NSFOCUS to conduct independent security assessments following the implemented changes2

2

. According to Z.ai, NSFOCUS confirmed that "all data objects in the zcode-prod Alibaba Cloud OSS bucket, as well as the bucket itself, have been deleted"3

3

. The third-party review found that no functional path capable of triggering the generation of local repository snapshots or transmitting local files externally was identified in the patched version.

The company enabled a zero-data retention feature on the coding assistant and pledged to release the full security assessment report soon5

5

. "Once again, we sincerely apologize and welcome continued scrutiny from the community," Z.ai wrote on Monday4

4

.

Broader Implications for AI Coding Assistant Security

This rare public disclosure of a security breach by a Chinese AI lab comes amid global warnings about frontier AI security risks. China's cyber regulator released an updated AI safety framework policy last week, warning about AI models' shutdown resistance, evaluator deception, and sandbox escape4

4

. The timing underscores growing regulatory attention to AI tool security vulnerabilities.

Security experts emphasize this isn't fundamentally an AI problem but an architecture issue. "This isn't really an AI model problem, it's an old-fashioned security architecture problem," said Cris Thomas, security advocate at Semgrep. "Giving an AI access to proprietary source code should require clear disclosure about what leaves the machine, where it goes, how long it's retained and who can access it, with the minimum permissions turned on by default, not the maximum"3

3

.

The Z.ai incident mirrors similar issues with U.S.-based AI companies. Elon Musk's xAI, specifically the Grok Build tool, faced scrutiny for similar unauthorized data upload practices earlier this year. Claude Code users have also raised data privacy concerns about their data being transmitted without consent1

1

.

What This Means for Enterprise AI Adoption

For enterprises evaluating AI coding assistants, this incident highlights the critical need to rigorously vet tools before deployment. Katie Paxton-Fear, staff security advocate at Semgrep, noted, "Given how much intellectual property is in code, it's not surprising that people are worried about it being sent to a third-party cloud provider"3

3

.

Z.ai, formerly known internationally as Zhipu, is among the world's AI heavyweights and the first AI company in the post-Gen AI era to IPO on the Hong Kong Stock Exchange2

2

. The company claimed last month that its GLM-5.3 model approaches Anthropic's Mythos in finding software vulnerabilities, becoming the first Chinese lab to explicitly delay an AI model release for safety reasons4

4

. OpenAI and Anthropic have reportedly expressed concern over the capabilities of models from Z.ai while the U.S. government considers restricting access2

2

.

Organizations should watch for Z.ai's promised full security assessment report and monitor whether the open-sourced codebase reveals additional insights into how AI coding assistants handle local workspace data. The incident serves as a reminder that default-enabled features with broad permissions pose significant risks, regardless of whether AI systems run locally or in the cloud.