Z.ai, the Chinese company behind the GLM model family, has open-sourced its ZCode coding assistant after fixing a flaw that quietly sent developers' local project files to Alibaba Cloud servers without their permission.

The issue came to light on September 18, when an independent Chinese technology blogger known as Ferstar uncovered files being prepared for upload to Alibaba's cloud storage while inspecting ZCode's working directory, the South China Morning Post reported.

The blogger found two encrypted files: a 313 megabyte compressed archive that was still awaiting transfer after 564 failed upload attempts, and a smaller 15-kilobyte file that had already been sent. Ferstar said the larger archive contained a snapshot of a commercial project he was developing, including its Git history. He told the SCMP that neither he nor the ZCode client could open the file, because it was encrypted with a private key held on Z.ai's back end.

How ZCode ended up uploading entire repositories

The unauthorized uploads were linked to a repository-indexing feature used for session checkpoints, version rollback and a "Repo Wiki." The feature was enabled by default after ZCode launched. Uploading an entire repository could be triggered simply by creating a new wiki page within the cloud, potentially exposing far more than the files a developer was actively working on. Git history can also make it easy to identify old credentials and hostnames, which renders a full repository snapshot particularly sensitive.

That default-on setup cuts to the core of why the incident resonated: AI coding assistants operate inside developers' local projects, so the settings such tools ship with determine what leaves a machine before any explicit user action.

A Shanghai-based developer quoted by the SCMP described the behavior as essentially stealing from users, adding that the possibility of malicious intent was the most troubling part.

What Z.ai says it has changed

Z.ai has apologized for the incident and said it has stopped the unauthorized uploads. The company also stated that any data sent to its cloud was destroyed and was never used to train its models. In addition, the Chinese AI firm said it plans to establish a permanent process for reporting product security vulnerabilities, with payouts based on the severity of the issue, and it has invited developers to continue auditing the now-open codebase.

Questions persist over the uploaded data, however, as outsiders still cannot verify exactly what happened to it.

A similar incident involving xAI's Grok Build occurred in July, when that coding tool was found to be uploading entire Git repositories. Musk confirmed that the uploads had taken place, after which xAI deleted the data and introduced a zero-retention policy along with a privacy endpoint. An independent retest later found that the uploads had stopped.

Z.ai, by contrast, has not announced any documented changes to its retention policy or allowed any form of independent retesting. The company's claim that the uploaded data was deleted remains difficult for outsiders to verify, particularly as it controls the only decryption key. Opening the code gives outside developers a new avenue of scrutiny, though auditing the client would not by itself settle questions about data that has already been uploaded.

Developers now have to decide whether to trust the tool

The fallout from the incident has continued to spread. A robotics company has reportedly banned Z.ai's tools internally, and developers told the SCMP that the damage to trust could prove more harmful than the specific bug itself.

The incident has also affected Z.ai's shares. Stock in Z.ai (2513.HK) fell by almost 6% during Monday's session before recovering to close 1.8% higher. The company traded at 794 HKD at the time of writing.

Attention now turns to whether the promised vulnerability-reporting program takes shape and whether independent developers auditing the open codebase surface anything that contradicts the company's account.