Z.ai's ZCode coding assistant silently uploaded users' workspaces to cloud storage
What happened
A developer found that Z.ai's ZCode desktop coding assistant, by default, packaged whole local workspaces including Git history and uploaded them to Alibaba Cloud storage while users were logged in, and that opt-out settings did not stop it. Z.ai apologized, removed the feature, deleted the bucket and open-sourced ZCode.
The archives were encrypted with a server-supplied key users could not decrypt. In the researcher's test a large commercial project snapshot never finished uploading, while a small public repository snapshot was accepted. How long the behavior ran and how many workspaces were captured is undisclosed; one company withdrew a claim that six of its workspaces were uploaded.
How it happened
Leaky AI product: App flaw. A security flaw in an AI application, such as broken login or access checks, let someone reach data they should not have seen.
Sources do not say whose AI model was involved. The product was ZCode (Z.ai, formerly Zhipu), a type of coding assistant.
Impact
Data was exposed. Data involved: source code. The impact was limited to a small number of people or a single system.
Severity is rated Low, calculated from how far the incident reached and how sensitive the data was.
Was the AI at fault?
No. The failure was in the systems, settings or people around the AI, not in the model's behaviour.
Status and timeline
Confirmed by the affected organization, the AI vendor, a regulator or a named security research firm.
It became public on 18 Sep 2026.
Z.ai disabled the snapshot workflow and removed Repo Wiki in v3.14.0, deleted the cloud bucket, said the data was never used for training, open-sourced ZCode on 22 September and commissioned CAICT and NSFOCUS assessments, which it says found the bucket empty.