Z.ai switched off features of its coding assistant ZCode on Monday. What came first: Chinese developers reporting that the tool had uploaded entire local code repositories to Alibaba Cloud servers without asking.
Z.ai names the cause itself. A feature called Codebase Indexing, on by default. The vulnerability is patched. What developers added: there was no toggle to turn the feature off, and the privacy policy never mentioned it.
How it went
Friday, Z.ai apologises and says the data has been deleted. Users push back. They found their uploaded files encrypted with a backend private key held only by Z.ai, which meant they could neither open the files nor verify the deletion.
The same day, a firm called Chengming Technology says six of its coding workspaces were uploaded without consent, including complete source code, database passwords and employee personal data. On Monday Chengming retracts, saying its evidence was wrong. It did not immediately respond to Reuters.
Also on Monday, Z.ai open-sources the assistant, which runs its own GLM-5.3 model, disables certain features and switches on zero-data retention. An independent assessment by the IT standards think tank affiliated with China’s industry ministry and by security firm NSFOCUS concludes the user code was deleted and was not retained on the cloud platform. The full report is promised.
Why the disclosure itself is notable
A Chinese AI lab publicly walking through a security failure is rare. Z.ai was also the first Chinese lab to hold a model back for safety reasons: GLM-5.3 shipped after a two-week review because it gets close to Anthropic’s Mythos at finding software vulnerabilities. And last week China’s cyber regulator updated its AI safety framework with warnings about shutdown resistance, evaluator deception and sandbox escape.
Codebase indexing is nobody’s safe default
This isn’t a China problem. Every useful coding agent builds an index of your project, and that index has to be built somewhere. The only questions are where – your disk or someone else’s servers – and whether you knew beforehand.
With Claude Code you can go and check. With other tools, not always. Take an evening and ask two things of every agent you run: which files does it read, and where do those files go. For ZCode the answer was in no setting and in no privacy policy.