Z.ai says sorry for slurping up your code, open sources ZCode

China’s AI darling goes on the defense after engineer highlighted Grok-esque security flaws

Windows CLOSEDQUORUM malware uses AI models to autonomously select post-compromise actions now

Windows CLOSEDQUORUM malware uses AI models to autonomously select post-compromise actions

Register reader hit with surprise bill after Microsoft portals disagreed 8 hours ago

Register reader hit with surprise bill after Microsoft portals disagreed

Perpetual underdog AMD nips at Nvidia's heels as it joins the $1T club 1 day ago

Perpetual underdog AMD nips at Nvidia's heels as it joins the $1T club

Treasury chief says AI bosses, not their bots, will carry the can for criminal acts 1 day ago

Treasury chief says AI bosses, not their bots, will carry the can for criminal acts

Google smacks forehead, realizes $899+ thin-and-lights were what it was missing 1 day ago

Google smacks forehead, realizes $899+ thin-and-lights were what it was missing

Chinese AI giant Z.ai has apologized after developers caught it pulling a Grok, packaging up and uploading user workspaces to cloud storage.

In a case that’s highly reminiscent of the issues over which Elon Musk’s xAI was scrutinized in July, Z.ai’s code-generation harness wing, ZCode, was found packaging and git-encrypting entire user workspaces, including complete project histories, and shipping them off to Alibaba Cloud.

Worse still, the private key used to decrypt the data was only held by the server under Z.ai’s control, meaning users could not access the files ZCode had uploaded, nor delete them.

They said the core problem lay with the tool’s Repository Index functionality, which triggered the uploading of files after Repo Wiki generated pages in the cloud.

ZCode released a statement on Monday apologizing for the “security issues” and confirming the data it uploaded had never been used to train its models.

“We sincerely thank the community developers who previously identified issues in ZCode. Going forward, we will establish an ongoing product security vulnerability reporting and response process,” it Xeeted.

“We welcome developers to continue reviewing ZCode and reporting potential issues, and we will provide rewards based on the severity of the issues reported.”

ZCode said it tasked the China Academy of Information and Communications Technology (CAICT) and Beijing security company NSFOCUS to probe its product following the implemented changes.

The company claimed the two outside assessments concluded that all the previously uploaded data has now been deleted and said the Repo Wiki feature was removed.

ZCode also open sourced the entire project on GitHub, “placing the code under community scrutiny and making ZCode more open and transparent.”

“Once again, we sincerely apologize and welcome continued scrutiny from the community. The full security assessment report will be released soon.”

Ferstar confirmed the open sourced code showed no signs of the Repo Wiki still being implemented, but criticized the company for wiping commit records and the source code ZCode used to upload files pre-patch.

For the uninitiated, Z.ai, formerly known internationally as Zhipu, is among the world’s AI heavyweights and one of the most heavily backed LLM-focused companies in China.

It is the first AI company in the post-Gen AI era to launch and subsequently IPO on the Hong Kong Stock Exchange. Other Chinese AI giants are publicly traded, such as Alibaba and Baidu, but these were all established well before the AI era began.

Z.ai is a startup with its roots in academic research. It spun out of Tsinghua University’s Knowledge Engineering Group research lab in 2019 and now develops AI models that it claims compete with the best in the West.

Last month, the company claimed that its latest model, GLM-5.3, is as good as the most advanced equivalents developed by Anthropic and OpenAI at hunting for security vulnerabilities.

Z.ai has also previously claimed the accolade of developing the first advanced model entirely on Chinese (Huawei) hardware .

Meanwhile, the likes of Anthropic and OpenAI have reportedly expressed concern over the capabilities of models from Z.AI and Moonshot, while the US government mulls restricting access. ®

Windows CLOSEDQUORUM malware uses AI models to autonomously select post-compromise actions

'first' publicly documented Windows implant to use LLMs for C2

Security firm finds naming AI agents after Seinfeld characters helps bots join the team

Not that there's anything wrong with it

HPE makes its “unified storage” claim real as B10000 R6 hits GA

PARTNER CONTENT: Pairs block and adjacent file workloads with independent scaling of performance and capacity

ShinyHunters claims FBI hack: 'This is NOT financially motivated'

This time it's personal

Your cloud survived everything except the real world

War damage, air traffic chaos, and a storage shortage expose the cost of treating resilience as someone else's problem

ABBYY gives old-school OCR a job in the AI pipeline

FineParser runs in a CPU-powered container, preserving tables and layout before handing documents to an LLM

SAAS Salesforce staggers back to feet after global outage

Salesforce staggers back to feet after global outage

databases Oracle celebrates banner quarter with another round of layoffs

Oracle celebrates banner quarter with another round of layoffs

Anthropic decides to support OpenAI's markdown instructions spec

Anthropic decides to support OpenAI's markdown instructions spec

Microsoft agentically ports Copilot runtime to Rust for $120K

Microsoft agentically ports Copilot runtime to Rust for $120K

ai and ml Ex-FTC boss Khan urges Uncle Sam to break out the handcuffs for AI CEOs, citing 1934 precedent

Ex-FTC boss Khan urges Uncle Sam to break out the handcuffs for AI CEOs, citing 1934 precedent

software Fedora 45 beta drags the Linux console into the 21st century

Fedora 45 beta drags the Linux console into the 21st century

Windows CLOSEDQUORUM malware uses AI models to autonomously select post-compromise actions 'first' publicly documented Windows implant to use LLMs for C2

Windows CLOSEDQUORUM malware uses AI models to autonomously select post-compromise actions

'first' publicly documented Windows implant to use LLMs for C2

Z.ai says sorry for slurping up your code, open sources ZCode China’s AI darling goes on the defense after engineer highlighted Grok-esque security flaws

Z.ai says sorry for slurping up your code, open sources ZCode

China’s AI darling goes on the defense after engineer highlighted Grok-esque security flaws

UPDAted Register reader hit with surprise bill after Microsoft portals disagreed Did Copilot write the synchronization code?

Register reader hit with surprise bill after Microsoft portals disagreed

Did Copilot write the synchronization code?

Perpetual underdog AMD nips at Nvidia's heels as it joins the $1T club Fueled by the AI boom, the House of Zen's rise isn't just Instinct - Lisa Su is riding high on some Epyc design chops too

Perpetual underdog AMD nips at Nvidia's heels as it joins the $1T club

Fueled by the AI boom, the House of Zen's rise isn't just Instinct - Lisa Su is riding high on some Epyc design chops too

Treasury chief says AI bosses, not their bots, will carry the can for criminal acts 'Humans are responsible, not the AI,' argues Scott Bessent as he calls out OpenAI agents' hack of Hugging Face

Treasury chief says AI bosses, not their bots, will carry the can for criminal acts

'Humans are responsible, not the AI,' argues Scott Bessent as he calls out OpenAI agents' hack of Hugging Face

Security Russians are posing as Signal support to launch phishing attacks PLUS: US takes down Iranian propaganda sites; Marketing company asks 'Why Do We Have Your Information?' And more!

Russians are posing as Signal support to launch phishing attacks

PLUS: US takes down Iranian propaganda sites; Marketing company asks 'Why Do We Have Your Information?' And more!

Security Microsoft patches failed to fix on-prem SharePoint, which is now under zero-day attack PLUS: China upgrades smartphone surveillance tools; Ring eases anti-snooping stance; and more

Microsoft patches failed to fix on-prem SharePoint, which is now under zero-day attack

PLUS: China upgrades smartphone surveillance tools; Ring eases anti-snooping stance; and more

Black Hat and DEF CON DEF CON Franklin project enlists hackers to harden critical infrastructure Voting village reports have been so successful, says Jeff Moss, that the whole of DEF CON will now be included

Black Hat and DEF CON

DEF CON Franklin project enlists hackers to harden critical infrastructure

Voting village reports have been so successful, says Jeff Moss, that the whole of DEF CON will now be included

Security EQT buys majority in Swiss cybersecurity biz Acronis Went at equivalent of $3.5B+ valuation for entire firm, though portion sold not specified

EQT buys majority in Swiss cybersecurity biz Acronis

Went at equivalent of $3.5B+ valuation for entire firm, though portion sold not specified

Malware Month Ten years since the first corp ransomware, Mikko Hyppönen sees no end in sight On the plus side, infosec's a good bet for a long, stable career

Ten years since the first corp ransomware, Mikko Hyppönen sees no end in sight

On the plus side, infosec's a good bet for a long, stable career

KDE turns 30 and someone's brought an AI-native desktop proposal Akademy talk imagines Plasma assembling itself around a personal model of each user

KDE turns 30 and someone's brought an AI-native desktop proposal

Akademy talk imagines Plasma assembling itself around a personal model of each user

Shopify extends lifeline to Tailwind as vibe coding erodes web dev platform's bottom line Acquisition gives open source CSS framework 'a stable long-term '

Shopify extends lifeline to Tailwind as vibe coding erodes web dev platform's bottom line

Acquisition gives open source CSS framework 'a stable long-term '

Switzerland tests a FOSS escape route from Microsoft 365 Swiss Army sticks a knife in American cloud apps with its own FOSS push

Switzerland tests a FOSS escape route from Microsoft 365

Swiss Army sticks a knife in American cloud apps with its own FOSS push

Feel peak Windows was 7? You might like Kumander Linux Debian and Xfce – solid, sensible choices – with a pretty skin

Feel peak Windows was 7? You might like Kumander Linux

Debian and Xfce – solid, sensible choices – with a pretty skin

Canonical shuttering some of its legacy chat channels The Ubuntu Pastebin went in June, IRC gets demoted

Canonical shuttering some of its legacy chat channels

The Ubuntu Pastebin went in June, IRC gets demoted

Audacity audio-editing app no longer looks like it's from the early 2000s The FOSS tool for audio editing has a fresh coat of paint, and new features to boot

Audacity audio-editing app no longer looks like it's from the early 2000s

The FOSS tool for audio editing has a fresh coat of paint, and new features to boot