Chinese artificial intelligence company Z.ai had to disable several features of its ZCode coding assistant this week after a default setting was caught sending users’ local code repositories to Alibaba Cloud servers in China without their consent, raising fresh concerns for enterprises over how AI tools handle sensitive source code.
The company apologised and said it had “completed the necessary remediation,” disabling the workflow responsible for generating and up local repository snapshots in its ZCode client. It has removed the feature from the latest release and opened up its codebase for public scrutiny, it said in a post on X.
The issue first surfaced through a technical investigation by an independent Chinese blogger, who described discovering abnormal disk usage and tracing it to ZCode’s background processes.
“Whenever you are logged in, ZCode silently packages your entire workspace — complete .git history, LFS asset cache, reflogs, and global app configs — encrypts it, and uploads it directly to Aliyun OSS,” Chinese blogger Ferstar wrote in a blog post detailing their investigation, according to a machine translation they provided.
According to the blogger, the ZCode coding assistant was not just accessing active files but capturing the broader development environment, effectively creating a pipeline from local systems to cloud storage.
The blogger said the data was uploaded to Alibaba Cloud object storage, raising concerns about how enterprise codebases including proprietary logic and embedded credentials could be handled once they left local environments.
Z.ai acknowledged the issue, thanking community developers for identifying it and committing to an ongoing vulnerability reporting and response process.
As part of its response, the company said it had disabled the repository upload mechanism, deleted associated cloud storage infrastructure, and implemented changes in the ZCode v3.14.0 client.
Z.ai also asked the China Academy of Information and Communications Technology (CAICT) and NSFOCUS to conduct security assessments.
“NSFOCUS confirmed that all data objects in the zcode-prod Alibaba Cloud OSS bucket, as well as the bucket itself, have been deleted,” Z.ai added in the post. “The Repo Wiki entry point and the associated generation workflow have been removed, and no functional path capable of triggering the generation of local repository snapshots or transmitting local files externally was identified.”
The company also said that no such data is retained and “has never been used for model training,” addressing concerns over downstream use of uploaded code.
In the Z.ai case, Ferstar’s findings showed that a default-enabled workflow could package and transmit entire repositories from local environments to cloud infrastructure without explicit user action, behavior the company later addressed in its remediation update.
“This isn’t really an AI model problem, it’s an old-fashioned security architecture problem,” said Cris Thomas, security advocate at Semgrep. If a coding assistant can “package up my entire repository and ship it somewhere I didn’t explicitly approve,” he said, the issue lies in how access and permissions are enforced.
“Giving an AI access to proprietary source code should require clear disclosure about what leaves the machine, where it goes, how long it’s retained and who can access it, with the minimum permissions turned on by default, not the maximum,” he said.
The risk extends beyond cloud-based deployments. Systems running locally can still expose sensitive data if they are granted broad filesystem access and unrestricted network connectivity, he added.
Semgrep staff security advocate Katie Paxton-Fear said, “Given how much intellectual property is in code, it’s not surprising that people are worried about it being sent to a third-party cloud provider,” adding that organizations need to more rigorously vet the AI tools they deploy.
Recent disclosures from OpenAI on model misalignment and reporting frameworks have also pointed to instances of unexpected system behavior, highlighting how AI systems can operate in ways not fully anticipated during deployment.