Z.ai's ZCode AI Coding Assistant Uploaded Developers' Code to Alibaba Cloud Without Consent
Z.ai reportedly disabled features of its ZCode AI coding assistant after developers reported it was uploading their local code repositories to Alibaba Cloud without consent. The company acknowledged the issue stemmed from a default-enabled feature and patched the vulnerability, though users reported the uploaded data remained encrypted with keys held only by Z.ai.
What happened
Z.ai's ZCode AI coding assistant uploaded entire local code repositories from developers' computers to Alibaba Cloud servers without their consent. The company said the issue originated from ZCode's "Codebase Indexing" feature which was enabled by default.
Z.ai disabled the affected features and patched the software vulnerability after Chinese developers reported the incident on social media. The company apologised and said the data had been deleted, but users reported the data was encrypted with a backend private key held only by Z.ai, preventing them from independently verifying deletion.
Reported impact
Chengming Technology reported that six of its company coding workspaces were uploaded to the cloud without consent, including sensitive data such as complete source code, database passwords and employees' personal information. The company later retracted this statement, saying it had "wrong evidence".
Developers reported on social media that there was no toggle to disable the feature and no prior acknowledgement in Z.ai's privacy policy.
Index analysis
The incident involved an AI-powered development tool uploading local code repositories to cloud storage without user consent or awareness, exemplifying risks of default-enabled data collection features in AI-integrated tools.
Governance controls
Z.ai said it would establish an ongoing product security vulnerability reporting and response process. The company open-sourced the coding assistant and pledged to make the product more transparent.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.