This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
Chinese startup Z.ai disabled features of its ZCode AI coding assistant after developers discovered it was uploading entire local code repositories, including sensitive passwords and source code, to Alibaba Cloud servers without consent.
Developers reported that Z.ai's ZCode AI coding assistant uploaded local code repositories to Alibaba Cloud without consent. Z.ai said a default-enabled Codebase Indexing feature caused the behavior, apologized, patched the vulnerability, and later disabled the upload path. One company retracted a separate claim that six workspaces containing sensitive data had been uploaded; Z.ai said independent reviews found no code data retained.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
AI systems that memorize and leak sensitive personal data or infer private information about individuals without their consent. Unexpected or unauthorized sharing of data and information can compromise user expectation of privacy, assist identity theft, or cause loss of confidential intellectual property.
Also classified as
The indexing feature was enabled by default with no toggle to disable it, no mention in the privacy policy, and users could not independently verify data deletion due to private key encryption.
The AI coding assistant compromised user privacy by uploading entire local code repositories, including sensitive source code and personal information, to cloud servers without user consent.
AI system
Due to a decision or action made by an AI system
Unintentional
Due to an unexpected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The data exposure was caused by the ZCode AI system's default indexing feature operating in an unexpected and unconsented manner after deployment.
Chinese startup Z.ai disabled its ZCode assistant's indexing feature after it was found uploading local code repositories and database passwords to Alibaba Cloud without user consent. Because the data was encrypted, subsequently deleted, and verified by an independent security audit, the national security impact is minor and limited to localized privacy and intellectual property exposure.
The system is explicitly described as an 'AI coding assistant' (ZCode) designed to run alongside developers to help write code, which fits the Assistant profile of augmenting human capabilities under human oversight.
Limited Risk: The system is an AI assistant and chatbot-like developer tool. The report notes 'Z.ai said on Monday that it had open-sourced the coding assistant... pledging to make the product more transparent', which aligns with transparency obligations for limited risk systems.
The AI system, ZCode, is explicitly identified as an 'AI coding assistant' running the GLM-5.3 model, designed to assist developers with writing and indexing code.
The report provides clear, direct facts about the technical behavior of the ZCode assistant, the specific cloud platform involved, the company's response, and the retraction by Chengming Technology. The core privacy and transparency issues are well-documented.
The incident could be viewed purely as a software engineering/vulnerability issue (7.3), but the lack of consent and default cloud-uploading behavior makes it primarily a privacy compromise (2.1).
Technology
Codebase Indexing Vulnerability
The Codebase Indexing feature had a software vulnerability that triggered unauthorized uploads.
Missing User Control Toggle
There was no toggle in the interface allowing users to disable the indexing feature.
Encryption Key Control Issue
Data was encrypted with a backend private key, preventing user verification of deletion.
Data Inputs
Local Code Repository Uploads
The tool automatically ingested and uploaded entire local Git repositories.
Sensitive Data Ingestion
The system uploaded sensitive files including database passwords and personal info.
Human Factors
Developer Alarm and Reports
Developers discovered and reported the unauthorized data transmission on social media.
Process and Methods
Default-on Indexing Policy
The codebase indexing feature was enabled by default without user consent.
Inadequate Privacy Policy
There was no prior acknowledgment of the indexing and uploading behavior in the privacy policy.
Lack of Vulnerability Process
No ongoing product security vulnerability reporting and response process was in place.
Management
Inadequate Release Review
Management released the indexing feature without sufficient security and privacy reviews.
Delayed Transparency
Initial lack of product transparency required post-incident open-sourcing of the assistant.
Regulatory Environment
Evolving Safety Frameworks
The incident occurred amidst tightening Chinese cyber regulations on model safety and escapes.
AI system involved
Identified by automated extraction; can differ from the alleged developers above.
