Z.ai pulls back key functions of ZCode after unauthorized code uploads

Z.ai disabled several functions of its ZCode AI coding assistant after users said the tool uploaded whole local code repositories to overseas cloud servers without consent. The problem stemmed from ZCode’s Codebase Indexing feature, which was turned on by default and sent code data to Alibaba Cloud. Z.ai, also called Zhipu, apologized on social media and said it had patched the vulnerability and will set up a permanent security reporting process. Developers reported that the uploaded files were encrypted with a private key held only by Z.ai, so they could not open the files or confirm deletion. They also noted that there was no toggle to turn off the feature and no mention of it in Z.ai’s privacy policy. Chengming Technology claimed six of its coding workspaces, including source code, database passwords and employee details, were uploaded, but later withdrew the statement, saying it had “wrong evidence.” An independent assessment by a ministry‑linked IT standards think‑tank and the cybersecurity firm NSFOCUS found the code data had been deleted and was not retained by the cloud platform. Z.ai said it had enabled a zero‑data‑retention mode for the assistant and opened the source code of the latest GLM‑5.3 model. The company invited developers to keep reviewing ZCode and report issues. The incident comes as China’s cyber regulator updated its AI safety framework, warning about model shutdown resistance, evaluator deception and sandbox escape, and follows recent US AI security alerts.