The Chinese AI provider Zhipu has apologized for a security vulnerability in its coding assistant ZCode: The tool uploaded complete developer workspaces unnoticed to the company’s own cloud. An affected company reported a single project with more than 32,900 files and around 411 million text characters – independently unverified. Zhipu has since disabled the function and disclosed the code.
Encryption Excludes Users From Their Own Data
The security researcher ferstar discovered the behavior on September 18, 2026, when he wanted to free up space on his MacBook, and published his analysis on the same day. ZCode had packed entire workspaces: complete Git directories, commit histories, LFS caches for binary files, and global program settings across multiple projects. A test project with 313 megabytes of compressed size contained 42,411 files alone, with the Git portion accounting for about 87 percent of the data package according to the analysis.
ZCode encrypted the packages with AES-256, while the necessary symmetric key was enclosed by RSA encryption. Problematic: the public RSA key was delivered anew by the Zhipu server with each connection, while the corresponding private key remained solely there. Users could not open their own data packages, often several hundred megabytes in size, on their own hard drives. The researcher interpreted this as an indication that the function was not a backup for users, but primarily served Zhipu itself – especially since the upload occurred independently of the settings in the program interface.
Affected Company Threatens Legal Action
The company Taiyuan Chengming Tech sent Zhipu a twelve-page legal notice after, according to its own statements, one of its projects was affected with around 32,900 files and about 411 million text characters – the exact number could not be independently verified. The company demands information about where the data was stored, whether it crossed national borders, and whether third parties or model training accessed it. Additionally, the company requests complete proof of deletion from servers, caches, and backup systems.
Similar incidents with AI coding tools are increasing: just at the beginning of September, the security company Air Security uncovered a vulnerability in four AI coding agents with Plugin4Shell, through which unverified code could be injected. The ZCode case runs in the opposite direction: here, not malicious commands flowed into the tool, but user data flowed out of it, all without the need for separate consent – a pattern that an analysis of SpaceXAI’s coding agent Grok Build had already exposed in July. Both cases show how little users of AI coding agents can currently control what is actually happening in the background. Security teams are now increasingly examining the network traffic of such tools instead of relying solely on manufacturer information.
Zhipu Closes the Gap and Opens the Code
Zhipu responded on September 18 with an initial statement, explaining that the function was officially intended for codebase indexing, for example for history recovery and the knowledge function Repo Wiki. With version 3.14.0, the company completely removed Repo Wiki and disabled the upload path. The security service provider NSFOCUS and the state-run China Academy of Information and Communications Technology subsequently confirmed independently that the affected storage area at Alibaba Cloud had been completely cleared.
Additionally, Zhipu published the complete source code of ZCode on GitHub – the tool has since been available for free download and viewing, even in Germany and the EU, eliminating a fixed rollout date for individual countries. A separate paid version has not yet been announced. For its own AI platform, Zhipu also announced new controls that allow users to exclude permanent storage of their inputs and outputs during standard model calls. Exceptions remain, according to company statements, for batch requests, file uploads, and data that must be retained for legal or security reasons.
It remains open whether the promised zero-data confirmation also applies to copies in backup and disaster recovery systems, which Taiyuan Chengming explicitly wants proven. It will also be crucial whether the now disclosed codebase withstands independent audits or whether similar upload mechanisms in other AI coding tools have so far only gone undetected.
