Z.AI open sources its coding harness ZCode and disables certain features after users said ZCode was uploading codebases onto overseas servers without consent

The ZCode tool will no longer upload your data without consent.

Chinese AI company Z.AI, also known as Zhipu AI and creator of the GLM models, is facing backlash after developers discovered its coding assistant tool, ZCode, was uploading local workspace data to overseas servers without explicit user consent. Reports indicate ZCode attempted to exfiltrate hundreds of megabytes of data, with one developer noticing a 313MB archive being prepared for upload. In response, Z.AI has apologized for the privacy breach, stating it has fixed the issue and that any uploaded data has been destroyed. To rebuild trust, the company announced plans to open-source the ZCode codebase and invite third-party security assessments.

The incident highlights a critical trust deficit in the AI development tools sector, particularly concerning data privacy and consent. As AI companies increasingly offer integrated coding assistants and local development tools, the potential for mishandling user data, whether intentional or not, becomes a significant risk. Z.AI's move to open-source ZCode and invite external audits is a step towards transparency, but the initial breach erodes confidence. Developers and organizations must now carefully evaluate the data handling practices of all AI-powered development tools they adopt, demanding clear consent mechanisms and robust security assurances.

This event signals heightened scrutiny on AI companies regarding data privacy, potentially leading to stricter industry standards and more rigorous security audits. The practice of uploading local codebases for AI model training or assistance, even for user benefit, is now under a microscope. Future developments in this area will likely prioritize on-device processing or explicit, granular consent for data exfiltration. Companies that can demonstrate transparent data handling and strong privacy controls may gain a competitive advantage in a market increasingly concerned with user data security.