Z.ai Disables ZCode Feature Following Unauthorised Code Repository Uploads

Z.ai has disabled several features of its ZCode coding assistant after discovering a flaw that allowed the tool to upload local code repositories to Alibaba Cloud servers in China without explicit user consent. The move follows reports that the tool was transmitting sensitive development data to third-party cloud infrastructure by default.

The issue was identified through a technical investigation by an independent researcher, Ferstar, who observed abnormal disk usage and traced the activity to ZCode’s background processes. The investigation revealed that when a user was logged in, ZCode would silently package entire workspaces, including .git history, LFS asset caches, reflogs, and global application configurations. These files were then encrypted and uploaded directly to Alibaba Cloud’s Object Storage Service (OSS).

This behaviour raised immediate concerns for enterprises regarding the exposure of proprietary logic, intellectual property, and potentially embedded credentials that may have been contained within the uploaded repositories.

Remediation and Security Audits

Z.ai apologised for the incident and stated that it has completed the necessary remediation. The company has disabled the specific workflow responsible for generating and uploading local repository snapshots and has removed the feature from its latest release. In the ZCode v3.14.0 client, the repository upload mechanism has been decommissioned.

As part of its response, Z.ai has deleted the associated cloud storage infrastructure. The company also requested that the China Academy of Information and Communications Technology (CAICT) and NSFOCUS conduct security assessments. Z.ai noted that NSFOCUS confirmed the deletion of all data objects within the relevant Alibaba Cloud OSS bucket and the bucket itself.

Addressing concerns regarding the downstream use of the data, Z.ai maintained that the transmitted information was never used for training its AI models and that no such data is being retained.

AI Security and Permission Risks

The incident has prompted discussion among security professionals about the boundaries of data access in AI-integrated development tools. Cris Thomas, a security advocate at Semgrep, suggested that the issue is a fundamental security architecture problem rather than a specific flaw in the AI model.

Thomas argued that if a coding assistant can package and ship an entire repository without explicit approval, the underlying issue lies in how access and permissions are enforced. He stated that providing AI access to proprietary code should require clear disclosure regarding what data leaves a machine, where it is stored, and how long it is retained, with the principle of least privilege applied by default.

Katie Paxton-Fear, also from Semgrep, noted that the significant amount of intellectual property residing in code makes the unauthorised transmission of files to third-party cloud providers a critical risk. She suggested that organisations must more rigorously vet the AI tools they deploy to prevent similar privacy and security breaches.