Z.ai faces backlash after its coding tool uploads local workspaces
Developers found ZCode sending encrypted Git snapshots to the cloud by default.
Chinese AI firm Z.ai, also known as Zhipu AI, is under fire after developers found that its coding assistant ZCode was uploading local project data to cloud storage without clear consent.
On Friday, a technical blogger writing as Ferstar inspected a local ZCode directory and found a 313MB encrypted archive queued for upload to Alibaba's cloud after hundreds of failed attempts. A smaller file had already gone. Filenames pointed to a commercial project snapshot, including Git history. Ferstar said neither he nor the ZCode client could decrypt the archive, because the private key sits on Z.ai's servers.
The South China Morning Post and The Next Web reported the company's apology. Z.ai said a repository indexing feature that supports checkpoints, rollback, and a Repo Wiki was on by default after launch, and that generating a Wiki page in the cloud could trigger an upload. The firm said uploaded data is destroyed once the Wiki is built. Ferstar asked how anyone outside the company can verify that claim when only Z.ai can open the files. Z.ai has promised to open-source ZCode and invite third-party review. At least one Chinese robotics employer has already banned the tools internally, according to SCMP.
Coding agents sit on the full history of a codebase, not just the file open in the editor. Credentials once committed, abandoned branches, and internal hostnames travel with that history.
The trust problem is sharper because Z.ai sells open-weight models and a closed client. Users who read a privacy policy about chat submissions had little reason to expect a silent workspace packager. When the archive is encrypted so only the vendor can read it, "we deleted it" becomes a statement no outsider can check.
Watch whether the promised open-source drop includes the uploader, and whether an independent retest shows the default uploads have stopped. The privacy policy still describes conversation submissions and has not been updated since the incident broke.