Z.ai's ZCode code-generation tool was found silently packaging and uploading users' entire project workspaces and histories to Alibaba Cloud without consent, with only Z.ai holding the decryption key, meaning users could not access or delete their own uploaded data. Z.ai apologized, said uploaded data was never used for training, removed the offending Repo Wiki feature, and open-sourced ZCode after third-party audits.
Disclosed 22 September 2026 · Record updated 1 October 2026
User code repositories and full project histories were uploaded without consent or disclosure to Alibaba Cloud servers controlled by Z.ai, with users unable to access or delete the uploaded data.
IncidentsThe Chinese AI firm removed the feature, commissioned two external audits and open-sourced its coding tool after developers found it shipping entire projects to Alibaba Cloud.
22 Sept 2026
