Product1 publisher2 min readPublished
Z.ai's ZCode uploaded whole developer workspaces to Alibaba's cloud by default
Z.ai has disabled the feature, deleted the cloud data and commissioned two outside assessments. For teams buying coding assistants, the test this leaves behind is measuring what the process sends before approving it.
The Product Desk · Product desk
What happened
- Users found ZCode packaging entire coding workspaces, including the full .git history, LFS cache, reflogs and global app configs, then encrypting the bundle and uploading it to Alibaba Cloud's Aliyun OSS.
- The uploads came from a Codebase Indexing feature that shipped on by default, and Reuters reported there was no toggle to switch it off and no description of the behavior in the privacy policy.
- Chengming Technology said six of its workspaces had been uploaded with source code, database passwords and employee personal information, then retracted the complaint citing wrong evidence.
Compiled by The Product DeskSomething wrong?How this is made
Why it matters
- constraint A security questionnaire answered from ZCode's own privacy policy would have cleared the tool, so document review cannot be the only control on software that reads a repository.
- exposure Anything a developer ever committed by mistake sat inside the indexed workspace, and Z.ai held the encryption keys, so customers could not inventory what actually went out.
- decision Every team already running an assistant has to decide whether default-on indexing blocks approval, knowing checkpoints and rollback stop working without it.
- precedent Z.ai's response package now gives customers something concrete to demand of other assistant vendors: an off switch, zero-retention options and a third party attesting that the bucket is gone.
Ferstar, an independent Chinese blogger, noticed abnormal disk usage on his own machine and traced it to ZCode background processes [3]. Mitch Ashley of The Futurum Group said: "The workspace uploads came to light because an independent blogger traced abnormal disk usage to a background process, well after developers had installed the tool" [12].
Nobody outside Z.ai could open the bundles. They were compressed and encrypted with keys held only on the company's servers, so users could not see what had left their machines [6]. When Z.ai apologized on Friday and said it had deleted the data, customers had no way to check either half of the claim [8].
Three days later the company disabled the upload mechanism in ZCode 3.14.0, deleted the related cloud storage, open-sourced the assistant built on its GLM-5.3 model and added zero-data-retention options [9][16]. It commissioned assessments from the China Academy of Information and Communications Technology, a think tank affiliated with China's industry ministry, and from the security firm NSFOCUS. The company said NSFOCUS had confirmed that the stored data and the storage bucket were deleted [10]. Z.ai said the data "has never been used for model training" [11]. Reuters reported the changes followed a week of public backlash [13].
The one detailed account of a company's secrets leaving has been withdrawn [7]. On the public record there is no confirmed case of a customer credential reaching Z.ai's storage.
Devops.com drew a lesson from the episode: treat coding assistants as privileged software. Ask vendors what leaves the machine, when, where it is stored and for how long [15]. Asking is where I would start. Before an assistant touches a real repository, measure what the process writes and transmits on a machine you control, with a checkout you are willing to lose. Then find out who holds the key to whatever leaves, since a deletion you cannot verify is only a promise. The cost of doing that is roughly a day of one engineer's time per tool, plus the features you go without while indexing is off. Session checkpoints, version rollbacks and wiki generation all depend on the index [4]. These tools sit next to .env files, credentials and commit history because deep context is what makes them useful [14]. I would hold default-on indexing as a blocker until it has been measured, and live without the rollbacks for the week that takes.
What to watch
- Whether CAICT and NSFOCUS publish their assessments in full, or customers get only Z.ai's summary of the findings.
- Whether Chengming Technology explains the "wrong evidence" behind its retraction.
- Whether other assistant vendors document where indexing data goes and give customers a switch to stop it.