Z.ai has disabled repository-upload features in its ZCode coding assistant and published the application’s source after developers reported that the tool sent entire local code repositories to Alibaba Cloud storage without consent. Reuters reported Monday that Z.ai apologized, removed the relevant features and promised a standing vulnerability-reporting process. The important development is not another AI company saying it takes security seriously. It is that a coding tool’s context pipeline reached far beyond the file a developer might reasonably expect it to read.
Z.ai said the behavior came from Codebase Indexing, which supported checkpoint recovery, version rollback and Repo Wiki. The feature was enabled by default. According to Reuters, users said there had been no switch that stopped the upload and no prior acknowledgment of the behavior in the privacy policy. Z.ai said the issue was patched and that uploaded data was deleted rather than retained or used for training.
The public scope remains incomplete. Reuters said one company initially claimed six workspaces containing source code, passwords and employee information were uploaded, then retracted that statement because its evidence was wrong. That retraction matters: it removes the most alarming corporate-exposure claim from the verified record. It does not erase the company’s own acknowledgment that repository data could leave users’ machines, or establish how many repositories were affected.
A Git repository is more than today’s code
A whole repository can include the current project, commit history, branches, author information and files removed from the latest version. Old secrets can survive in history after disappearing from the working directory. That makes repository-wide collection materially different from sending the open file or a deliberately selected folder to a cloud model.
Seoul Economic Daily reported that the developer who exposed the behavior found a roughly 10-gigabyte project compressed into a 313-megabyte archive for upload. The publication also reported a dispute over when the transfer occurred: Z.ai tied it to generating a repository description page, while the developer said older versions attempted it when a user submitted a query. Those are not equivalent descriptions, and the released evidence does not yet resolve the difference.
The strongest defense of Z.ai’s response is substantial. The company did not merely rename a toggle. It says version 3.14.0 removed the Repo Wiki entry point and snapshot-upload path, commissioned assessments from an industry-affiliated standards institute and security firm, and confirmed that the storage bucket and its objects were deleted. It also released the ZCode desktop, web, backend, interface and agent-runtime code under an Apache 2.0 license. Researchers now have a real codebase to inspect and rebuild, which is more useful than a carefully moisturized apology.
But open source is a forward-looking control, not a time machine. Publishing today’s repository does not by itself prove that earlier distributed binaries match the new source, reveal every historical network request or independently verify deletion from cloud storage. Reuters says Z.ai plans to publish the full assessment report; until that appears, the deletion and remediation findings remain reported company claims supported by named assessors, not a complete public audit.
TINA’s view: consent has to control the wire
TINA’s view: Z.ai’s remediation is directionally right and unusually concrete, but the original design failed a basic boundary. A feature that packages a repository for cloud processing needs an explicit description of what leaves the device, a separate opt-in before transmission, visible scope controls and a switch that actually prevents network egress. Encryption and deletion after processing reduce exposure after collection; they do not supply consent before collection.
The counterargument is that useful repository-wide features need repository-wide context, and a cloud service cannot build a project wiki from files it never receives. Correct—but that makes precise permission more necessary, not less. Developers routinely work in codebases containing customer material, infrastructure details and credentials. “The feature needed it” is an engineering explanation, not authorization.
This judgment would soften if Z.ai publishes a reproducible audit mapping the shipped binaries to the released source, documents the affected versions and population, and provides verifiable retention and deletion records. It would strengthen if researchers find another upload path, a mismatch between binaries and source, or evidence that the feature bypassed stated controls after the claimed fix.
The next signal is the promised full security assessment, followed by independent network testing of current builds. Z.ai has cut the visible pipe and opened the machine. Now outsiders need to confirm that the pipe is truly gone—and determine what passed through it before anyone was looking.
