Z.ai apologizes and disables its ZCode feature that uploaded developers' code to Alibaba's cloud without asking
Prepared by Sintelligent with the help of SI. Publication time restored from the build log. . Updated: .
Coding agents are trusted with a company's entire codebase, and one quiet default-on feature turns the assistant into a leak.
Beijing-based Z.ai (Zhipu) admitted that the uploads came from a "codebase indexing" feature (used for checkpoints, version rollback and wiki generation) that was on by default, could not be turned off by users, and was not mentioned in the privacy policy. The company disabled the feature, released a fix and said the uploaded data has been deleted; this was confirmed by the cybersecurity firm NSFOCUS and a think tank under China's Ministry of Industry and Information Technology. Z.ai promised a permanent process for receiving vulnerability reports; Reuters called it a rare public disclosure of a security problem by a Chinese SI lab.
Sources 2