ZCode uploaded users' workspace data to Alibaba Cloud while they were logged in
Ferstar found a 313 MB encrypted package and a smaller upload containing 538 files
Z.ai says code repository indexing caused uploads and data was destroyed after Wiki generation
Z.ai says it fixed the issue, plans to open-source ZCode and will hire third-party auditors
Ferstar says users cannot independently verify that uploaded data was destroyed
Z.ai shares fell 4.9% in Monday morning trading
Chinese AI company Z.ai is facing backlash after its coding assistant ZCode quietly uploaded users' workspace data to a server, raising concerns over how the platform handles sensitive data.
Independent developer Ferstar wrote in a blog post on Friday that ZCode was packaging and encrypting users' workspaces and uploading the data onto Alibaba Cloud's object storage service while users were logged in.
Ferstar found a 313-megabyte compressed package containing a commercial project pending upload, while a smaller package that contained 538 files had been successfully uploaded. The developer added that the mechanism was enabled by default, with no option for users to disable it.
Later on Friday, Z.ai released a notice in a ZCode user group, stating that the issue stemmed from the platform's "code repository indexing" feature, which supports functions including historical version rollback and Repo Wiki, according to reports from multiple local tech news outlets and the South China Morning Post.
The company said that repository data could be uploaded when the Wiki interface was being generated, but that the data was immediately destroyed once the process was complete.
Z.ai added that the team has fixed the issue and will open-source ZCode's codebase and engage third-party auditors.
Ferstar, however, wrote in a Saturday update that it remained unclear how users could independently verify that the uploaded data had been immediately destroyed.
Hong Kong-listed shares of Z.ai fell 4.9% in Monday morning trading, with the market still open. The Latent has reached out to Z.ai for further comment.
AI oversight
The controversy came at a time when AI's growing power and autonomy are creating urgent new security risks. Anthropic CEO Dario Amodei has called for slowing the pace of frontier AI development - an idea also backed by OpenAI's Sam Altman, Google DeepMind's Demis Hassabis, and xAI founder Elon Musk.
U.S. President Donald Trump and Chinese President Xi Jinping are expected to discuss the opportunities and threats associated with AI at their upcoming meeting on Sept. 24. Ahead of the meeting, U.S. Treasury Secretary Scott Bessent said recent talks with Chinese officials on AI, trade and investment were "very successful," according to Bloomberg.
