Z.ai Disables ZCode After It Uploaded Git History to the Cloud
Z.ai has disabled parts of its ZCode coding assistant after developers found it silently uploading local code repositories, including full Git history, to Alibaba Cloud object storage without consent. The GLM maker says the uploads were encrypted and the affected features are now disabled, but the incident has become a trust problem for the Chinese lab.
On this page
What developers found
Z.ai, the Chinese lab behind the GLM model family, has disabled parts of its ZCode coding assistant after developers discovered the tool was silently uploading local code repositories to the cloud. Per SCMP's coverage, Z.ai faced a reputation hit after users spotted ZCode packaging entire workspaces, including full Git history, and uploading them to Alibaba Cloud object storage without explicit permission. The uploads were encrypted such that only Z.ai could open what it had collected, which is cold comfort if you never asked for the upload in the first place.
The company said on Monday it had disabled the affected features in response to user reports, citing security and privacy concerns about source-code exposure. A deleted cloud bucket later became part of the story, deepening the suspicion around what had been collected and where it went. The issue traces to ZCode's codebase indexing feature, which has since been fixed.
Why this one matters more than a typical telemetry story
Coding assistants occupy a unique trust position. They are granted access to the most sensitive artifact most developers have: a complete repository, with history, secrets that leaked into commits, and the architecture of whatever product it powers. A chatbot leaking a prompt is embarrassing; an assistant uploading a Git history is potentially every credential and customer record in that history.
The incident also lands on Z.ai at a delicate moment. The lab's GLM models are the most prominent Chinese open-weight family, and Z.ai has been courting exactly the developer audience, the people who run models locally and read their network logs, that this breach will now make skeptical. In response to the fallout, Z.ai has open-sourced ZCode, a move that lets the community audit the code paths in question directly.
The local-model lesson in the incident
For this site's readers, the lesson is not that AI coding assistants are unsafe; it is that any tool with repository access is also a data egress risk, and the guarantee you care about is what leaves the machine. A local model processes your code where it sits; an assistant with cloud indexing ships it somewhere else as a feature. The ZCode episode is the clearest recent example of the difference being load-bearing rather than philosophical.
The practical checks follow from the failure mode. Watch egress from your development machine: the uploads went to Alibaba Cloud object storage, so a DNS or HTTP log would have shown them. Read what a coding assistant's indexing feature does before enabling it, because indexing is the word that means copying. And treat Git history as the sensitive artifact it is, since rotating exposed secrets after an upload is the only remediation that matters.