Chinese AI company Z.ai is facing privacy concerns after users reported that its ZCode coding tool uploaded local files to external servers without providing a way to disable the upload function.
The issue came to light on 18 September 2026, when a Chinese technology blogger inspecting a ZCode directory discovered a compressed file waiting to be uploaded to Alibaba Cloud.
The 313MB file reportedly failed to upload hundreds of times, while a smaller 15KB file was successfully transferred. The larger file appeared to contain material from a commercial project based on visible filenames.
Other ZCode users later reported similar concerns.
Z.ai apologised and said it had fixed the issue. The company also indicated that it would open-source the relevant code and allow independent reviewers to examine it. It further said that affected uploaded data had been destroyed and committed to introducing a data non-retention policy for its model-as-a-service platform.
However, questions remain over how users can independently verify that uploaded information has actually been deleted.
The incident has also highlighted broader concerns around AI-powered development tools, which can have access to highly sensitive information stored within developers’ workspaces.
Findlay Whitelaw, Field CISO at Exabeam, said developer environments can contain source code, credentials and intellectual property, making visibility into how AI tools use that access increasingly important.
He said security teams need to understand what these tools are expected to do and identify behaviour that differs from those expectations.
The incident comes as AI coding assistants become increasingly integrated into software development, raising fresh questions around access controls, data governance and transparency.
Main Image: Cyber Magazine
