2 hrs ago
Z.ai Disables Coding Features After Reported Code Uploads
Z.ai makes a computer tool called ZCode that helps people write software.
Some users said the tool copied all of their code files without asking first.
They reported that the files were sent to cloud computers.
Chinese developers said the files went from Git to Alibaba Cloud.
Z.ai said the problem came from a feature called Codebase Indexing.
That feature was turned on automatically.
The company apologized and said it fixed the software weakness.
Z.ai also turned off some ZCode features while dealing with the problem.
Z.ai disabled some features of its ZCode AI coding assistant on Monday.
Users reported that ZCode uploaded entire local code repositories without their consent.
Chinese developers said the code was sent from Git to Alibaba Cloud.
Z.ai said its default-enabled Codebase Indexing feature caused the issue.
The company apologized and said it had patched the software vulnerability.
- Who
- Z.ai, also known as Zhipu AI or Knowledge Atlas Technology, and users of its ZCode coding assistant.
- What
- Z.ai disabled some ZCode features after users reported that the tool uploaded local code repositories without consent.
- Where
- The company is based in Beijing, China; users reported transfers to overseas cloud servers, including Alibaba Cloud.
- When
- The company announced the feature disabling on Monday and said on Friday that it had patched the vulnerability.
- Why
- Z.ai said the issue originated with the default-enabled Codebase Indexing feature.
User concerns
Z.ai response
Unauthorized code uploads
User concerns
Users reported that ZCode uploaded entire local code repositories without their consent, with Chinese developers saying the data went from Git to Alibaba Cloud.
Z.ai response
Z.ai said the issue came from its Codebase Indexing feature, which was enabled by default, and said it had patched the vulnerability.
Immediate action
User concerns
Developers raised concerns publicly after observing the reported code transfers.
Z.ai response
Z.ai disabled some ZCode features and apologized after the reports.
Key facts
- Company
- Z.ai, also known as Zhipu AI or Knowledge Atlas Technology
- Affected product
- ZCode AI coding assistant
- Disabled features
- Some ZCode features
- Reported data
- Entire local code repositories
- Problematic feature
- Codebase Indexing, enabled by default
- Reported cloud destination
- Alibaba Cloud
- Company response
- Z.ai apologized and said it patched the software vulnerability
Sources
Related news
Plugin4Shell Hits Four Major AI Coding Assistants; Two Unpatched
Researchers Used Claude to Reach OpenAI Internal Systems
OpenAI Agents Linked to RubyGems Attack Before Hugging Face
AI Assistants Turned Account Access Into OpenAI Code Breach
Anthropic Accuses Chinese AI Labs of Secret Claude Data Routing
Hugging Face Turns AI Attack Into Open-Source Crusade
GitHub outage disrupts web, API traffic and downloads
Linus Torvalds Uses AI for AudioNoise Project
Power Dressing: Influential Women and Their Signature Bags
