Z.ai disables coding assistant feature after flaw exposed enterprise code upload risk
Z.ai disabled ZCode features after a default workflow uploaded local code repositories to Alibaba Cloud.
Z.ai disabled features of its ZCode coding assistant after a default-enabled workflow was found packaging users' local workspaces—including full git history, LFS caches, reflogs, and app configs—and uploading them to Alibaba Cloud object storage without explicit consent. Blogger Ferstar traced abnormal disk use to ZCode background processes. Z.ai said v3.14.0 removes the repository-snapshot workflow, NSFOCUS confirmed the zcode-prod bucket was deleted, and the data was never used for model training. The company also asked CAICT and NSFOCUS to assess the issue.
- A default ZCode workflow packaged entire local repositories, including git history.
- Snapshots were uploaded to Alibaba Cloud OSS without explicit user consent.
- Z.ai removed the feature in ZCode v3.14.0 and said the bucket was deleted.
- The company said uploaded code was never used for model training.
From the original article
3 min read at csoonline.com
Chinese artificial intelligence company Z. ai had to disable several features of its ZCode coding assistant this week after a default setting was caught sending users’ local code repositories to Alibaba Cloud servers in China without their consent, raising fresh concerns for enterprises over how AI tools handle sensitive source code.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.