Chinese AI company Z.ai (Zhipu) disabled parts of its flagship coding assistant ZCode on September 21, 2026, after it was discovered that the assistant was uploading entire local code repositories to the cloud without consent. The issue was discovered by independent Chinese blogger Ferstar, who tracked the assistant's background processes. Z.ai apologized, removed the disputed infrastructure, released ZCode's code publicly on GitHub, and enabled zero-data retention, but its assurances about data deletion and non-use for model training have not yet been confirmed by independent verification.

image

What happened

The cause of the disablement was the Codebase Indexing feature, which was enabled by default: it silently packaged the developer's working environment — full .git history, LFS asset caches, reflog, and global configs — encrypted the packages with Z.ai's key, and sent them to Alibaba Cloud OSS. There was no toggle to disable it, and the upload was not mentioned in the privacy policy. Independent Chinese blogger Ferstar noticed the abnormal disk consumption: he tracked ZCode's background processes and published an investigation describing the upload mechanics. On September 21, 2026, Z.ai disabled the feature and removed all indexing infrastructure in the ZCode v3.14.0 release: the company apologized to users, released the assistant's code publicly on GitHub (zai-org/ZCode) under the GLM-5.3 model, enabled zero-data retention, and stated that the uploaded data from the zcode-prod bucket had been deleted and was never used to train models.

Context

The incident is not related to the model, but to classic access engineering: the indexing feature operated with maximum rather than minimum privileges and silently exported proprietary code and credentials embedded in repositories to a third-party cloud. The story is all the more notable because a month earlier, Z.ai was the first among Chinese AI labs to delay the release of the GLM-5.3 model by two weeks for security reasons, and the incident occurred against the backdrop of fresh warnings from Chinese regulators about AI safety. Public acknowledgment of such a leak from a Chinese AI lab is rare, and it sets a precedent for transparency for the entire category of tools that are perceived as local but are invisibly connected to cloud infrastructure.

Why this matters for the industry

For the industry, this is a signal: trust in AI assistants is turning from a marketing checkbox into a verifiable product characteristic. Some of ZCode's enterprise clients will likely pause deployments, and procurement departments will start asking all vendors about default telemetry and code uploads. The market will likely respond with new default hygiene: codebase indexing will become opt-in with explicit consent, local indexes, transparent privacy policies, and verifiable zero-data retention will appear as a condition for corporate deployment. For builders, a short window has opened — the niche of "local-first indexing, transparent egress, and explicit consent" is empty, and the ZCode incident makes it a product rather than an image issue. ZCode's open code, meanwhile, sets a bar below which it is risky for competitors to fall: client openness is turning from a gesture of trust into a competitive advantage.

Why this matters for users

If you use AI coding assistants (ZCode, Copilot, Claude Code, and others), conduct a settings audit: which features are enabled by default, exactly what leaves the machine, and whether there are options for indexing, telemetry, and zero-data retention. ZCode's behavior can now be verified independently — the v3.14.0 release code is open on GitHub (zai-org/ZCode), and the absence of uploads can be seen through network activity analysis of new builds. If the assistant was operating in environments with secrets, assess the scale of exposure: full .git history, reflog, and global configs were uploaded, meaning the risk zone includes proprietary code and embedded credentials. The general lesson for teams is to demand explicit consent and minimum privileges from any tools with access to the file system.

What is still unknown / limitations

Z.ai's assurances that all data has been deleted and was never used for training are methodologically unverifiable by a third party: without access logs, data on the provenance of training corpora, and independent access to infrastructure, these are statements of intent, not the result of a reproducible check. The open client code allows verifying behavior on the user's machine, but not server-side claims. The CAICT and NSFOCUS audits are not yet proof, but a claim to proof: the methodology, check period, sample size, and raw reports have not been published, and the independence of the parties is limited, as CAICT is a think tank under the Ministry of Industry, and NSFOCUS is a commercial security vendor. Finally, the withdrawal of claims by Chengming Technology removes the harshest accusations — database passwords and personal data — but does not prove their absence: users could not view the contents of the upload because the packages were encrypted with Z.ai's private key.

Sources

Author

Look at AI, editorial team