Zhipu AI apologizes after ZCode uploads developer files to cloud

Zhipu AI, a Beijing-based artificial intelligence startup, has apologized and taken corrective action after its AI coding assistant, ZCode, was found to be uploading local developer files to Alibaba Cloud without explicit user consent. The issue was identified by independent researchers who discovered that the tool was creating encrypted archives of local repositories, including Git history, and attempting to upload them to remote servers.

Zhipu AI attributed the incident to the “Codebase Indexing” feature, which was enabled by default. This feature was intended to support functions like session recovery and the creation of a “Repo Wiki,” but it triggered unauthorized data transfers. Users noted that the files were encrypted with a private key held only by Zhipu AI, preventing developers from independently verifying the contents or confirming the deletion of their data.

In response, Zhipu AI has released the ZCode source code under an Apache 2.0 license to allow for community oversight and transparency. The company has also disabled the problematic Repo Wiki and codebase indexing features in the latest version of the software. Third-party security audits conducted by CAICT and NSFOCUS confirmed that the relevant cloud storage buckets have been cleared of the uploaded data. Additionally, Zhipu AI announced plans to implement a “zero data retention” policy for its MaaS platform to protect sensitive user inputs.