Incident #1714
Z.ai's ZCode AI Coding Assistant Reportedly Uploaded Developers' Local Code Repositories to Alibaba Cloud Without Consent
Description
Developers reported that Z.ai's ZCode AI coding assistant uploaded local code repositories to Alibaba Cloud without consent. Z.ai said a default-enabled Codebase Indexing feature caused the behavior, apologized, patched the vulnerability, and later disabled the upload path. One company retracted a separate claim that six workspaces containing sensitive data had been uploaded; Z.ai said independent reviews found no code data retained.
Actors
Alleged Deployers
- z.ai
- ai-service-providers
Alleged Developers
- z.ai
- ai-software-developers
Harmed Parties
- zcode-users
- information-integrity
- privacy
- software-developers
- ai-coding-assistant-users