Beijing, September 22, 2026
Chinese artificial intelligence company Z.ai, also known as Zhipu, has disabled some features of its ZCode coding assistant following a security controversy involving the handling of developers’ local code repositories.
The Beijing-based company took action after developers reported that ZCode was uploading local code data to Alibaba Cloud without their explicit consent. Z.ai subsequently apologised, said it had patched the underlying vulnerability and moved to make the coding tool more transparent.
The incident is notable because AI coding agents can be granted extensive access to developers’ local files, repositories, commands and development environments. That makes clear permission controls and data-handling practices particularly important as these tools become more autonomous.
What Happened With ZCode?
The controversy emerged after Chinese developers began reporting unusual data transfers involving ZCode, Z.ai’s AI-powered coding assistant.
According to Reuters, users reported that complete local code repositories were being uploaded from their development environments to Alibaba Cloud.
Z.ai said the problem originated in a feature called “Codebase Indexing.”
The feature was enabled by default.
According to the company, it has now patched the software vulnerability associated with the issue.
ZCode’s September 19 release notes also record a fix for an issue involving “abnormal uploads in the repository wiki,” providing additional confirmation that the company made a software change related to repository uploads.
Why Developers Raised Privacy Concerns
The issue attracted attention because the information involved was not necessarily limited to small code snippets deliberately submitted to an AI model.
Developers reported that larger portions of their local development environments and Git repositories could be packaged and transferred.
Some users also said that they could not find a switch to disable the relevant functionality and that the behaviour had not previously been clearly acknowledged in Z.ai’s privacy policy.
Another concern involved encryption.
According to users cited by Reuters, uploaded data was encrypted using a backend private key controlled by Z.ai. That meant affected developers could not independently open the uploaded archives or verify for themselves that the data had subsequently been deleted.
Those claims contributed to the broader concern around the incident even after Z.ai said the data had been removed.
Company Claim About Six Workspaces Was Later Retracted
One of the more serious early allegations came from Chinese technology company Chengming Technology.
The company initially said that six of its coding workspaces had been uploaded by ZCode without consent and alleged that the information included source code, database passwords and employees’ personal information.
However, Chengming Technology subsequently retracted that statement, saying it had relied on “wrong evidence.”
That retraction is important when assessing the incident: the broader ZCode data-upload issue was acknowledged by Z.ai, but the specific claim concerning those six workspaces and their alleged sensitive contents should not be presented as established fact.
Z.ai Apologises and Disables Features
Z.ai initially apologised on Friday and said the affected data had been deleted.
The company went further on Monday, announcing that it had disabled certain ZCode features and open-sourced the coding assistant.
The company said:
“We welcome developers to continue reviewing ZCode and reporting potential issues.”
Z.ai also pledged to introduce a more systematic approach to handling future security problems.
“Going forward, we will establish an ongoing product security vulnerability reporting and response process,” the company said.
The decision to open-source the coding tool gives outside developers greater ability to inspect how ZCode operates, although transparency of source code does not by itself resolve every question around server-side infrastructure or data handling.
Independent Assessment Says User Code Was Deleted
Z.ai also announced the results of an independent security assessment.
According to the company, the review was conducted by an IT standards think tank affiliated with China’s industry ministry together with Chinese cybersecurity company NSFOCUS.
Z.ai said the assessment found that users’ code data had been deleted and was not retained by the cloud platform.
The company further said it had enabled a zero-data-retention capability for the coding assistant used by developers and technology enterprises.
Z.ai said:
“Once again, we sincerely apologize and welcome continued scrutiny from the community. The full security assessment report will be released soon.”
The finding about deletion is therefore based on the independent assessment as reported by Z.ai. The company has said that a complete assessment report will be made available.
ZCode Has Now Been Open-Sourced
Another significant response to the controversy was Z.ai’s decision to make ZCode open source.
Z.ai said on Monday that it had open-sourced the coding assistant that runs its latest GLM-5.3 AI model.
This move could allow developers and security researchers to examine more of the software’s behaviour rather than relying entirely on the company’s description of how the application works.
It also represents an attempt by Z.ai to rebuild confidence among developers after criticism over the undisclosed upload behaviour.
ZCode Was Launched as a Competitor to Major AI Coding Tools
ZCode is a relatively new entrant in the increasingly competitive AI coding-agent market.
Z.ai introduced the desktop coding application in 2026 as a tool capable of automating software-development tasks and competing with products in the rapidly expanding AI coding ecosystem.
The platform has evolved beyond conventional code completion into agent-style functionality capable of performing longer and more complex development tasks.
Its current documentation shows that ZCode provides multiple permission modes governing how its agent can modify files and execute commands.
The default mode, “Ask before changes,” requires confirmation before file edits or commands. More permissive modes allow progressively greater automation.
That distinction matters because the security model of an AI coding agent involves more than the capabilities of the underlying language model. It also depends on what files, commands, networks and external systems the surrounding software can access.
GLM-5.3 Adds Another Security Dimension
The incident comes shortly after Z.ai released its GLM-5.3 model.
Z.ai has promoted GLM-5.3 not only for software development but also for its cybersecurity capabilities. The company previously said the model approaches leading frontier systems in its ability to identify software vulnerabilities.
The company delayed GLM-5.3’s release for approximately two weeks for a security review, according to Reuters.
That creates an important distinction between two types of AI security.
One concerns model capabilities—what an AI system can discover or execute.
The other concerns product security and privacy—what information an AI application collects, where that information is transmitted and whether users have knowingly authorised that transfer.
The ZCode incident falls primarily into the second category.
Why This Incident Matters Beyond Z.ai
AI coding assistants increasingly operate with access that conventional chatbots do not have.
Depending on their configuration, coding agents may be able to inspect repositories, edit files, execute terminal commands, interact with development tools and make network requests.
For businesses, those repositories can contain proprietary source code, internal architecture, configuration files and other commercially sensitive information.
As a result, developers evaluating coding agents increasingly need to understand not only which model produces the best code, but also:
what local files the agent can access;
whether repository data leaves the device;
where that information is processed;
whether data retention can be disabled;
which actions require explicit approval; and
whether the product’s actual behaviour matches its privacy disclosures.
The ZCode episode illustrates why these questions are becoming central to enterprise adoption of agentic coding tools.
Z.ai Faces a Test of Developer Trust
Z.ai has responded to the incident with several measures: patching the vulnerability, disabling certain features, apologising, commissioning a security assessment, enabling zero-data retention and making ZCode open source.
The company’s next challenge will be demonstrating that those changes translate into predictable and transparent behaviour for developers.
Z.ai has promised to establish an ongoing vulnerability reporting and response process and says it will publish the full security assessment.
For developers and companies considering AI coding agents, the episode provides a broader lesson: increasingly capable coding assistants require equally strong controls around permissions, transparency and sensitive source-code data.
