Chinese artificial intelligence company Z.ai has disabled some features of its ZCode coding assistant after developers reported that the software uploaded entire local code repositories to cloud servers without their consent.
Beijing-based Z.ai, also known as Zhipu, apologised after Chinese developers said ZCode had transferred code from their local Git repositories to Alibaba Cloud. The company said the problem originated from its Codebase Indexing feature, which had been enabled by default.
Z.ai said it has now patched the issue and promised to introduce a permanent vulnerability-reporting and security-response process.
Proposal for Conducting Cyber Crisis Drill, Tabletop Exercise (TTEx) & CCMP Readiness Exercise
Coding assistant uploaded repositories to cloud storage
ZCode is an AI coding assistant that works with software projects stored on a developer’s computer.
The controversy began after developers found that the application was creating encrypted copies of their local projects and attempting to upload them to cloud infrastructure.
One developer who investigated the software found a 313MB encrypted archive containing a commercial project waiting to be uploaded. According to the South China Morning Post, the archive included the project’s Git history, while a smaller file had already been successfully transferred.
The larger archive had reportedly attempted to upload 564 times.
Reuters said developers complained that there was no clear switch to disable the Codebase Indexing feature and that the practice had not previously been disclosed in Z.ai’s privacy policy.
Z.ai said the feature was responsible for the uploads and that the vulnerability had been fixed.
Why uploading a code repository is sensitive
A code repository is more than a collection of files used to build software.
Developers often use Git repositories to keep the complete history of a project. That history may include earlier versions of source code, internal configuration files, development notes and information about how an application changed over time.
In commercial projects, such repositories may contain valuable intellectual property.
They can also contain credentials or configuration data if developers accidentally save sensitive information alongside the code.
This is why an AI coding tool uploading an entire project can create a much greater security problem than sending a small piece of code that a developer deliberately asks the AI to review.
The issue becomes even more important inside companies, where developers may be working with proprietary software or customer systems.
Users could not independently verify deletion
Z.ai initially said the uploaded data had been deleted.
However, developers said the files were encrypted using a backend private key controlled by Z.ai. This meant users could not open the encrypted files themselves or independently confirm what had been uploaded and whether it had actually been deleted.
Z.ai later said an independent security assessment carried out by a think tank affiliated with China’s Ministry of Industry and Information Technology and cybersecurity company NSFOCUS found that users’ code had been deleted and was not retained by the cloud platform.
The company also said it had enabled a zero-data-retention feature for developers and enterprise users.
Z.ai said it would release the full security-assessment report.
Z.ai open-sources ZCode after incident
The company has also taken the unusual step of open-sourcing ZCode.
Z.ai said on Monday that making the coding assistant’s source code public would allow developers to examine how the software works and report potential security problems.
The move gives outside researchers greater visibility into the client-side software, although it does not by itself provide independent visibility into everything happening on Z.ai’s backend servers.
The company said it welcomes developers continuing to review the product and report vulnerabilities.
Its September 21 ZCode release notes also show continued updates to the desktop tool, including bug fixes affecting computer control and other functions.
AI coding tools face growing data-security scrutiny
The incident comes as businesses increasingly allow AI assistants to work directly inside software-development environments.
These tools can read project files, generate code, run commands and sometimes interact with external services.
That access makes them useful, but it also means companies need to know exactly which data leaves a developer’s machine.
Source code can contain commercially sensitive information that organisations may not want transferred to third-party cloud infrastructure, particularly without explicit approval.
Z.ai’s disclosure is also significant because public security acknowledgements of this type remain relatively uncommon among major Chinese AI developers.
The company has recently promoted security as an important part of its AI strategy. Reuters reported that Z.ai delayed the release of its GLM-5.3 model for two weeks to carry out a safety review before releasing it last month.
The ZCode incident shows that model safety is only one part of AI security.
How AI applications handle local files, corporate code and cloud uploads can be just as important.
What this means for you: Developers and companies using AI coding assistants should check whether repository indexing or cloud-sync features are enabled by default. Sensitive source code should not be exposed to external AI tools unless the organisation understands exactly what data is uploaded, where it is stored and how long it is retained.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
