China's Z.ai Suspends AI Coding Features After Unauthorized Code Uploads

Chinese AI startup Z.ai, also known as Zhipu, has temporarily disabled certain features of its ZCode coding assistant after developers reported that the tool uploaded entire local code repositories to foreign cloud servers without authorization.

The incident, which surfaced over the weekend of September 20-21, 2026, has become one of the most significant trust breaches in the AI coding assistant market — and a cautionary tale for any developer relying on AI tools that access local codebases.

What Developers Reported

Users in China raised concerns that ZCode, Z.ai's primary coding assistant, had transferred code data from local Git repositories to Alibaba Cloud without explicit permission. The uploads appeared to happen automatically, triggered by a default setting rather than an opt-in choice.

For developers working on proprietary code, sensitive infrastructure, or client projects under confidentiality agreements, unauthorized cloud uploads represent a serious breach — regardless of whether the data was subsequently deleted.

Z.ai's Response

The company issued an apology via social media on Monday, September 22. Z.ai attributed the issue to ZCode's "Codebase Indexing" feature, which was enabled by default. The company released a software patch to address the behavior and stated that an independent security evaluation confirmed users' code data had been deleted from the cloud platform.

The evaluation was conducted by a think tank affiliated with China's industry ministry, in partnership with cybersecurity firm NSFOCUS. Z.ai reported that the assessment verified data was not retained on cloud servers.

However, users noted that while files were erased, they remained encrypted with keys held by Z.ai — meaning the company could theoretically access them. Z.ai has not publicly confirmed deletion of encryption keys or provided independent verification of key destruction.

Broader Changes Announced

In response to the backlash, Z.ai announced several structural changes:

• Making the coding assistant open-source, utilizing its latest GLM-5.3 AI model
• Disabling specific features to enhance transparency
• Implementing a zero-data retention policy for the coding assistant used by developers and tech companies
• Committing to publish a comprehensive security assessment report

"Once again, we sincerely apologize and welcome ongoing scrutiny from the community," the company stated.

Context: Z.ai's Market Position

Z.ai has been one of China's most prominent AI companies, positioning its GLM models as competitive with Western alternatives. The GLM-5.3 model was released following a two-week testing period, with Z.ai claiming performance comparable to Anthropic's Claude. The company marked a milestone as the first Chinese AI firm to reach certain capability benchmarks.

The ZCode assistant was a key product in Z.ai's developer strategy — competing directly with GitHub Copilot, Cursor, and other AI coding tools. The unauthorized upload incident threatens that positioning at a moment when trust is the most valuable asset in the AI coding market.

Lessons for Developers Everywhere

The Z.ai incident is not unique to Chinese AI companies. It reflects systemic risks in AI coding assistants that every developer should understand:

Default settings matter. Features like codebase indexing, cloud sync, and telemetry are often enabled by default. Review every setting before connecting an AI tool to a repository containing sensitive code.

Read the data flow. Understand where your code goes when an AI assistant analyzes it. Local-only processing, on-premises deployment, and explicit opt-in cloud features are meaningfully different from default cloud uploads.

Verify deletion claims. When a company says data was deleted, ask whether encryption keys were also destroyed. Encrypted data with retained keys is not truly deleted.

Open-source as accountability. Z.ai's decision to open-source the coding assistant is a positive step, but open-source code does not automatically mean safe defaults. Review the source, audit the network calls, and test in isolated environments.

The Competitive Landscape

Western AI coding tools have faced their own security challenges in 2026. The Plugin4Shell vulnerability affected Claude Code, Codex, GitHub Copilot, and Google's Gemini CLI — allowing attackers to swap reviewed plugin code for malicious code without user interaction. Anthropic and OpenAI patched their tools; Microsoft has not fixed Copilot; Google will not fix the retiring Gemini CLI.

The Z.ai incident adds a different dimension: not external attackers exploiting vulnerabilities, but the tool itself mishandling user data through design choices. For enterprise buyers evaluating AI coding assistants, data handling policies may matter more than model capability scores.

What Happens Next

Z.ai's promised security assessment report will be closely watched. If it provides verifiable evidence of complete data deletion — including key destruction — the company may recover developer trust. If gaps remain, competitors will capitalize on the breach to position their tools as more privacy-respecting.

For the AI industry broadly, the incident reinforces a pattern: as coding assistants gain deeper access to developer environments, the consequences of misconfiguration, poor defaults, and inadequate transparency grow proportionally. The race to ship features is outpacing the race to earn trust.