Z.ai Disables Features After Unauthorized Code Uploads to Cloud

• •Z.ai disabled features after unauthorized uploads of user code to Alibaba Cloud.
• •The incident involved sensitive data, including source code and personal information.
• •Z.ai has committed to improving security processes and transparency.

Chinese AI startup Z.ai, also known as Zhipu, has disabled certain features of its AI coding assistant, ZCode, after users reported unauthorized uploads of local code repositories to Alibaba Cloud. The issue arose from a default-enabled 'Codebase Indexing' feature, which led to sensitive data, including source code and personal information, being uploaded without consent. Although Z.ai initially stated that the data had been deleted, users found it was encrypted with a private key only accessible to Z.ai, raising concerns about the actual deletion. The incident, which was highlighted by a technical blogger, has prompted Z.ai to patch the vulnerability and commit to improving transparency and security processes. An independent security assessment confirmed that the uploaded data was deleted and not retained. The incident has sparked discussions about the implications for Z.ai's reputation amid increasing scrutiny of AI security risks.