Security1 publisher2 min readPublished
Z.ai switches off the ZCode indexing default that copied repositories to Alibaba Cloud
ZCode's Codebase Indexing shipped enabled and developers found their Git repositories on Alibaba Cloud. Z.ai patched it and cited an outside assessment saying the uploads are deleted; verifying that is out of the affected users' hands.
The Watch · Security desk
What happened
- Z.ai said on Monday it had disabled some features of its flagship AI coding assistant after users reported it was uploading entire local code repositories to overseas cloud servers without consent.
- The company traced the uploads to ZCode's Codebase Indexing feature, which was enabled by default, and said on Friday that it had patched the software vulnerability.
- Developers writing on X and the Chinese platform RedNote said the feature had no off switch, and that Z.ai's privacy policy had said nothing about the behaviour beforehand.
- Chengming Technology said on Friday that six of its company coding workspaces had been uploaded without consent, including complete source code, database passwords and employees' personal information.
- Chengming Technology retracted that statement on Monday, saying it had wrong evidence, and did not immediately respond to a request for comment.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- exposure A default-on indexing path makes the exposed asset the working tree, so every machine that ran the client before the patch put its keys, dumps and config files in the same place as its source.
- constraint Customers cannot document what left their own machines, because the copies were encrypted with a key only Z.ai holds.
- contradiction With the one itemised customer account withdrawn, the description of what the uploads contained now rests on the vendor's own statements.
- precedent Opening the client's source mid-incident hands the upload path to outside reviewers, and raises the bar for the next assistant vendor caught in the same position.
Developers' reports said the code went out of Git and into Alibaba Cloud, according to Reuters [2]. For anyone running the client, that puts the whole working tree in scope.
Z.ai apologised on Friday, September 18, and said the data had been deleted [5][18]. Users then said the uploaded files were encrypted with a backend private key held only by Z.ai, so they could not open their own files or independently confirm that deletion [6]. Monday's answer was a third-party report: Z.ai said an independent assessment by the Chinese industry ministry's affiliated IT standards think tank and the cybersecurity firm NSFOCUS found users' code data had been deleted and was not retained by the cloud platform [11]. The company also said it had enabled a zero-data retention feature on the assistant, which is used by developers and tech enterprises [12].
"Once again, we sincerely apologize and welcome continued scrutiny from the community. The full security assessment report will be released soon," Z.ai wrote on Monday [13]. It has yet to appear. Z.ai referred Reuters to its public statements when asked for further comment on the incident [14].
Until this, the lab's safety record was about model behaviour. Z.ai said last month that its GLM-5.3 model approaches Anthropic's Mythos in finding software vulnerabilities, and that it released the model after a two-week review, becoming the first Chinese lab to explicitly delay a release for safety reasons [15]. China's cyber regulator published an updated AI safety framework last week warning about models' shutdown resistance, evaluator deception and sandbox escape [16].
Reuters described the episode as a rare public disclosure of a security breach by a Chinese AI lab, and noted it follows several U.S. AI companies disclosing AI hacking and "rogue" agent incidents in recent weeks [20]. "Going forward, we will establish an ongoing product security vulnerability reporting and response process," Z.ai said on ZCode's official X account on Monday [4].
What to watch
- Publication of the full security assessment report Z.ai says is coming, and whether it counts affected repositories.
- Whether the open-sourced ZCode client shows what the indexing path transmitted, and to which endpoints.
- Whether Chengming Technology explains what its "wrong evidence" was.