Z.ai pulls coding assistant feature after silent code uploads to China cloud
Z.ai disabled a default-enabled workflow in its ZCode assistant that packaged and uploaded entire local repositories to Alibaba Cloud storage without user consent. The company apologized, removed the feature, and opened its codebase for public review. Independent researchers found the tool captured full .git history and global configs, raising enterprise concerns about sensitive source code handling.
The investigation by blogger Ferstar revealed ZCode's background processes were packaging complete development environments, not just active files. Whenever a user was logged in, the tool encrypted and transmitted .git history, LFS asset caches, reflogs, and global configuration files to Alibaba Cloud object storage, effectively creating an automated pipeline from local systems to external infrastructure.
Z.ai's remediation involved disabling the upload mechanism, deleting the zcode-prod cloud storage bucket, and releasing client version 3.14.0. The company enlisted CAICT and NSFOCUS for security assessments, with NSFOCUS verifying complete deletion of all data objects and confirming no functional path remains for triggering external file transmission. Z.ai also stated the data was never used for model training.
This incident could reshape how enterprises evaluate AI coding tools, particularly regarding data sovereignty and default permission settings. Organizations may now demand stricter disclosure about what data leaves their environments, where it is stored, and how it is handled. The case could influence procurement decisions and accelerate adoption of self-hosted AI assistants, especially for companies managing proprietary code or operating under regulatory constraints that restrict cross-border data transfers.