Sep 18, 2026Unverified
Z.ai's ZCode AI Coding Assistant Reportedly Uploaded Developers' Local Code Repositories to Alibaba Cloud Without Consent
AI loose in the worldData exfiltrationDERIVED
Approved by person, Oct 11, 2026. How entries are approved
Developers reported that Z.ai's ZCode AI coding assistant uploaded local code repositories to Alibaba Cloud without consent. Z.ai said a default-enabled Codebase Indexing feature caused the behavior, apologized, patched the vulnerability, and later disabled the upload path. One company retracted a separate claim that six workspaces containing sensitive data had been uploaded; Z.ai said independent reviews found no code data retained.
What this means for youIf you use an AI coding tool, it may send your private project files to outside servers without asking, so check its settings for default-on indexing or upload features. At work, companies should review which AI tools can read or send source code before letting staff use them.
Sources
- AI Incident Databasehttps://incidentdatabase.ai/cite/1714
Data from the AI Incident Database (incidentdatabase.ai), licensed CC BY-SA 4.0 (https://creativecommons.org/licenses/by-sa/4.0/). McGregor, S. (2021) Preventing Repeated Real World AI Failures by Cataloging Incidents: The AI Incident Database. IAAI-21.
Source data license: CC BY-SA 4.0 (database). Report contents keep their own rights; reports.text, submissions, images and videos are excluded from the data license.
Covered by snapshot 45
da93f03b406f409940d0a6ef47b526607f82ebf457d98f69299b88aceede576a
This entry is record number 1937. It has not been edited since it was approved; the hash above would not match if it had. How to verify