3Arabi Z.ai's ZCode Uploaded Entire Codebases to Alibaba Cloud Without Consent. Now Its Features Are Disabled.
Chinese developers discovered Z.ai's ZCode coding assistant shipping their repositories to Alibaba Cloud through a default-on Codebase Indexing feature. Z.ai apologized, patched it, and disabled features — but users can't verify their data was actually deleted.
The worst kind of bug report is the one where the vendor’s tool does exactly what the user never asked it to do. Last week, Chinese developers found that Z.ai’s ZCode AI coding assistant was uploading their entire local code repositories to Alibaba Cloud — without consent, without a toggle to stop it, and without any prior mention in the privacy policy.
On Monday, Z.ai (also known as Zhipu) said it had disabled some features of its flagship coding assistant. In a statement on Friday, the Beijing startup said the uploads came from ZCode’s “Codebase Indexing” feature, which was enabled by default, and that it had patched the underlying software vulnerability.
What was uploaded
Developers wrote on social media and X that ZCode pushed their code data from Git to Alibaba Cloud. One Chinese tech firm, Chengming Technology, said six of its company coding workspaces were uploaded without consent — including complete source code, database passwords, and employees’ personal information. The company later retracted its statement on Monday, saying it had relied on “wrong evidence.” Z.ai referred Reuters to its public statements when asked for further comment.
The harder problem is verifiability. Z.ai apologized on Friday and said the data had been deleted — but users found the uploaded data was encrypted with a backend private key held only by Z.ai, meaning they could neither open their own uploaded files nor independently confirm deletion. That gap is the difference between an incident response and an assurance.
What Z.ai says it’s doing now
On Monday, Z.ai said it had open-sourced the coding assistant that runs its latest GLM-5.3 model and disabled certain features, and that it enabled a zero-data retention feature. The company said an independent security assessment — conducted by a think tank affiliated with China’s industry ministry and cybersecurity firm NSFOCUS — found users’ code data had been deleted and was not retained by the cloud platform. The full report, Z.ai said, “will be released soon.”
That is a vendor claim about an assessment that has not yet been published. Treat the findings as asserted, not established. What is established: developers’ code left their machines without their consent, through a default-on feature with no off switch.
Why it matters beyond one company
Coding assistants index your codebase — that is their core value proposition. The trust bargain is that the indexing stays under your control. A default-on upload with no toggle breaks that bargain, and the encryption detail makes it worse: when users cannot inspect what was taken, “we deleted it” is a promise they have to take on faith.
The timing is sharp. China’s cyber regulator released an updated AI safety framework last week, flagging shutdown resistance, evaluator deception, and sandbox escape. Just last month, Z.ai positioned itself as the safety-conscious Chinese lab: its GLM-5.3 model approaches Anthropic’s Mythos at finding software vulnerabilities, and the company delayed its release by two weeks for a safety review — the first Chinese lab to publicly delay a model for safety reasons. Now the same company is apologizing for a basic data-handling failure in the product that runs that model.
Developers evaluating any coding agent — not just ZCode — can take one practical rule from this week: check what your assistant uploads before it indexes, not after. The feature was enabled by default. The off switch did not exist. That combination is the story.