-7.png?w=1024)
Z.ai has disabled parts of its AI coding assistant after developers reported that it packaged local project data and attempted to send it to cloud storage without clear user consent.
Chinese AI company Z.ai, formerly known as Zhipu AI, said Sept. 21 that it had disabled features in ZCode after developers found the tool creating repository snapshots and attempting to upload them to Alibaba Cloud.
Developers traced the behavior to ZCode’s Codebase Indexing feature, which was enabled by default. They reported that the feature could package repositories, including Git histories, without presenting a clear, user-facing option to disable the process.
Independent developer Ferstar reported finding a 313MB encrypted archive containing a snapshot of a commercial project and its Git history. The archive reportedly generated 564 failed upload attempts, while a separate 15KB file was successfully transmitted, according to the South China Morning Post. The report did not establish whether the smaller file contained source code or other project data.
Z.ai opens ZCode to public review
Z.ai apologized and said it had completed security remediation. The company also published ZCode’s client-side source code for public inspection.
"Going forward, we will establish an ongoing product security vulnerability reporting and response process," Z.ai said in a statement. The company said ZCode version 3.14.0 removed the Repo Wiki feature and disabled the workflow responsible for generating and uploading local repository snapshots. Z.ai also said the China Academy of Information and Communications Technology and cybersecurity company NSFOCUS independently assessed the remediation.
CAICT found the relevant Alibaba Cloud storage bucket in a zero-data state, while NSFOCUS said the bucket and its data objects had been deleted.
"Once again, we sincerely apologize and welcome continued scrutiny from the community," Z.ai said.
What the security checks found
The independent assessments are important because Z.ai initially faced questions over whether uploaded files could be independently verified as deleted. The reported archives were encrypted with keys controlled by Z.ai, meaning affected developers could not simply open the files themselves to determine exactly what had been transmitted.
Z.ai said the relevant storage infrastructure had been cleared and the affected workflows removed. However, the full assessment reports had not been published when this article was written, limiting independent scrutiny of their findings.
Why this could matter for AI coding tools
The incident exposes a difficult problem for AI coding assistants: they often need access to large portions of a developer's workspace to provide useful context, but that access can create significant privacy and security risks when data leaves the user's machine.
The issue goes beyond source code for enterprise customers. Developer workspaces can contain configuration files, credentials, internal documentation and other information that organizations do not intend to send to an AI provider. Z.ai’s decision to publish ZCode’s client-side source code could give security researchers more visibility into how the software handles local data. But transparency after an incident does not eliminate the need for developers and companies to verify how future versions behave.
What it means for ZCode users
Existing users should review ZCode’s release notes, data-handling documentation and network behavior before reconnecting the tool to sensitive repositories. The company’s remediation removes the reported snapshot-upload workflow, while its external assessments offer some reassurance about the affected cloud storage. However, the complete assessment reports have not yet been released.
Organizations should treat AI coding assistants as part of the broader software development toolchain and apply the same security controls used for other software that can access proprietary code. Before deployment, security teams should test these tools in an isolated environment, monitor outbound network traffic, restrict access to secrets and unnecessary directories, and confirm their data-retention and external-transfer policies.
Z.ai said it would reward developers who report future security issues based on severity. The reporting program could improve scrutiny, but organizations should still independently verify how future ZCode versions access, store and transmit repository data.