AI Coding Tool Was Quietly Uploading Your Entire Codebase to China

Key points

• Z.ai's ZCode coding assistant was uploading complete local code repositories, including full version histories and embedded credentials, to Alibaba Cloud servers in China without user consent, before a fix landed in ZCode v3.14.0.
• An independent blogger, Ferstar, discovered the behaviour by tracing abnormal disk activity to a background process that ran whenever a user was logged in.
• Z.ai confirmed it deleted all stored data from its cloud bucket and says the uploaded code was never used to train its AI models.
• The issue was a configuration default, not a software vulnerability: the upload workflow was switched on out of the box.

A coding assistant, meaning a software tool that sits inside a developer's editor and helps write or review code, was quietly sending entire project archives to cloud servers in China without telling anyone. That is the finding at the centre of this week's disclosure about ZCode, a product made by Chinese AI company Z.ai.

The behaviour came to light through a personal investigation by a blogger named Ferstar, who noticed unusual disk activity and traced it back to ZCode's background processes. According to a machine-translated account of Ferstar's findings, the tool was packaging the full workspace, including the complete version history stored in a .git folder (a record of every change ever made to a project), cached large files, and global application settings, then encrypting the bundle and uploading it to Alibaba Cloud OSS (object storage, roughly the Chinese equivalent of Amazon S3) without any prompt to the user.

Why does this matter to people who don't write code?

Source code is often the most sensitive intellectual property a company owns. It can contain passwords and proprietary business logic embedded directly in the files, alongside private encryption keys. Once that material lands on a third-party cloud server, the original owner loses visibility over who can access it, how long it's kept, and whether it feeds into other systems.

The upload did not require a deliberate action from the user. It was the default. That distinction is important: this was not a feature that some users unwisely switched on, but one that ran for anyone who had logged into ZCode.

What has Z.ai done about it?

Z.ai acted quickly once the community report surfaced. The company disabled the repository-upload workflow, removed the feature from ZCode v3.14.0, and published its codebase for public inspection. It also asked two external bodies, the China Academy of Information and Communications Technology and the security firm NSFOCUS, to audit its systems.

NSFOCUS confirmed that all stored objects in the relevant Alibaba Cloud bucket, and the bucket itself, have been deleted. Z.ai stated the uploaded data was never used for model training, though independent verification of that claim isn't possible from public records.

Cris Thomas, a security advocate at Semgrep (a code-analysis company), put the problem plainly when CSO Online covered the story: the issue is not the AI model itself, it's a basic permissions design failure. Any tool that can package a full repository and transmit it without explicit approval is misconfigured at the architecture level, regardless of what sits on top of it.

That framing matters for any business evaluating AI development tools right now. The question to ask of any coding assistant is not only what the model does with your code inside the session, it's what the client software does with your files between sessions, on disk and over the network. This is the same question researchers raised in our 27 August story on Amazon's Kiro tool leaking secrets through hidden project-file instructions, and it's one the industry still hasn't answered well.

Developers who used ZCode before v3.14.0 should update now, audit what credentials appeared in any workspace the tool had access to, and rotate any exposed keys or passwords.

Common questions

Who is affected?

Anyone who installed ZCode before version 3.14.0 and was logged into the application could have had their local code repositories uploaded. The upload ran in the background by default.

Is the uploaded data still on Alibaba Cloud's servers?

Z.ai says no, and NSFOCUS confirmed the bucket and all its contents were deleted. There is no independent way for outside parties to verify that nothing was copied before deletion.