Z.ai's ZCode AI Coding Assistant Reportedly Uploaded Developers' Local Code Repositories to Alibaba Cloud Without Consent

Developers reported that Z.ai's ZCode AI coding assistant uploaded local code repositories to Alibaba Cloud without consent. Z.ai said a default-enabled Codebase Indexing feature caused the behavior, apologized, patched the vulnerability, and later disabled the upload path. One company retracted a separate claim that six workspaces containing sensitive data had been uploaded; Z.ai said independent reviews found no code data retained.

Risk classification

• Primary risk domain: 2 Privacy & Security
• Primary risk subdomain: 2.1 Compromise of privacy by obtaining, leaking or correctly inferring sensitive information

The AI coding assistant compromised user privacy by uploading entire local code repositories, including sensitive source code and personal information, to cloud servers without user consent.

Additional risk subdomains

• 7.4 Lack of transparency or interpretability: The indexing feature was enabled by default with no toggle to disable it, no mention in the privacy policy, and users could not independently verify data deletion due to private key encryption.

Causal factors

• Entity: AI
• Intent: Unintentional
• Timing: Post-deployment

The data exposure was caused by the ZCode AI system's default indexing feature operating in an unexpected and unconsented manner after deployment.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Limited Risk: The system is an AI assistant and chatbot-like developer tool. The report notes 'Z.ai said on Monday that it had open-sourced the coding assistant... pledging to make the product more transparent', which aligns with transparency obligations for limited risk systems.

AI system and alleged parties

• AI system: ZCode (Zhipu AI)
• AI purpose: Code Generation; Technical Text Generation
• Behaviour type: Assistant
• Alleged developer: Z.ai, AI software developers
• Alleged deployer: Z.ai, AI service providers
• Alleged harmed parties: ZCode users, Software developers, Privacy, Information integrity, AI coding assistant users

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Minor. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Negligible, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Minor, indirect Negligible
• Psychological: direct Negligible, indirect Negligible
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Privacy

Reported: The report explicitly describes privacy violations where local code repositories containing sensitive data were uploaded to cloud servers without consent.

Directly caused: The ZCode assistant uploaded local code repositories, potentially including sensitive source code, database passwords, and employees' personal information, to Alibaba Cloud servers without user consent.

Inferred additional harm: It is highly likely that numerous other developers and enterprises using ZCode had their proprietary codebases and sensitive credentials uploaded to the cloud without their knowledge before the feature was disabled.

People affected

• Occurrences reported: 1
• People reportedly exposed: 10

Potential causes

Management

• Inadequate Release Review: Management released the indexing feature without sufficient security and privacy reviews.
• Delayed Transparency: Initial lack of product transparency required post-incident open-sourcing of the assistant.

Technology

• Codebase Indexing Vulnerability: The Codebase Indexing feature had a software vulnerability that triggered unauthorized uploads.
• Missing User Control Toggle: There was no toggle in the interface allowing users to disable the indexing feature.
• Encryption Key Control Issue: Data was encrypted with a backend private key, preventing user verification of deletion.

Data Inputs

• Local Code Repository Uploads: The tool automatically ingested and uploaded entire local Git repositories.
• Sensitive Data Ingestion: The system uploaded sensitive files including database passwords and personal info.

Human Factors

• Developer Alarm and Reports: Developers discovered and reported the unauthorized data transmission on social media.

Process and Methods

• Default-on Indexing Policy: The codebase indexing feature was enabled by default without user consent.
• Inadequate Privacy Policy: There was no prior acknowledgment of the indexing and uploading behavior in the privacy policy.
• Lack of Vulnerability Process: No ongoing product security vulnerability reporting and response process was in place.

Regulatory Environment

• Evolving Safety Frameworks: The incident occurred amidst tightening Chinese cyber regulations on model safety and escapes.

Information quality

• Classification confidence: High
• Reason for confidence: The report provides clear, direct facts about the technical behavior of the ZCode assistant, the specific cloud platform involved, the company's response, and the retraction by Chengming Technology. The core privacy and transparency issues are well-documented.
• Ambiguities identified: There is some ambiguity regarding the exact number of affected developers and whether Chengming Technology's retraction was due to actual 'wrong evidence' or external pressure.
• Alternative interpretations: The incident could be viewed purely as a software engineering/vulnerability issue (7.3), but the lack of consent and default cloud-uploading behavior makes it primarily a privacy compromise (2.1).

Chinese startup Z.ai disabled its ZCode assistant's indexing feature after it was found uploading local code repositories and database passwords to Alibaba Cloud without user consent. Because the data was encrypted, subsequently deleted, and verified by an independent security audit, the national security impact is minor and limited to localized privacy and intellectual property exposure.

• Overall national security impact: Minor
• Scope: Single nation
• Primary target: China
• Alleged perpetrator: Z.ai

Threat characteristics

• Imminence: Long-term. The features have already been disabled, the code open-sourced, and an independent audit confirmed data deletion, making this an ongoing compliance and policy concern rather than an active crisis.
• Autonomy: Human-supervised. The ZCode AI assistant operates as a developer tool under human supervision, although the background codebase indexing and uploading feature executed automatically without explicit user consent.
• Novelty: Established threat. Unintentional data exposure, over-collection of telemetry, and unauthorized cloud synchronization are well-established software security and privacy issues.

Impact by dimension

• Physical security: Negligible. The incident involves a coding assistant uploading software repositories to a cloud server. There is no evidence of impact or threats to physical security, kinetic weapons, or critical infrastructure systems.
• Information security: Minor. While local code, database passwords, and employee information were uploaded to Alibaba Cloud, the data was encrypted with Z.ai's backend private key, and an independent security assessment confirmed the data was deleted. No intelligence compromise or information warfare operations occurred.
• Sovereignty: Negligible. The incident did not affect state authority, border controls, electoral systems, or core government decision-making processes.
• Economic security: Minor. Proprietary source code and database credentials from commercial entities like Chengming Technology were temporarily exposed to cloud servers. However, the data was deleted, limiting strategic economic or technological competitive damage.
• Societal stability: Minor. The incident involved unauthorized collection of personal employee data and code repositories, representing a minor privacy compromise, but did not result in mass surveillance, systematic discrimination, or civil unrest.