PrivacyMedium
Z.ai's ZCode AI Coding Assistant Reportedly Uploaded Developers' Local Code Repositories to Alibaba Cloud Without Consent
- Occurred
- Sep 18, 2026
- Published
- Sep 21, 2026
- Source
- AI Incident Database
Summary
Developers reported that Z.ai's ZCode AI coding assistant uploaded local code repositories to Alibaba Cloud without consent. Z.ai said a default-enabled Codebase Indexing feature caused the behavior, apologized, patched the vulnerability, and later disabled the upload path. One company retracted a separate claim that six workspaces containing sensitive data had been uploaded; Z.ai said independent reviews found no code data retained.
Developers
- Z.ai
- AI software developers
Deployers
- Z.ai
- AI service providers
Harmed parties
- ZCode users
- Information integrity
- Privacy
- Software developers
- AI coding assistant users
Classification
Category confidence: 95%
Severity confidence: 90%
Rationale: Unauthorized data upload of local code repositories without consent constitutes a privacy violation.
Classifier: Qwen/Qwen3.5-35B-A3B-FP8