Z.ai Admits ZCode Secretly Uploaded User Data by Default

Z.ai has acknowledged a significant security flaw in its ZCode coding agent, admitting that the tool was configured to upload local user data to external servers by default. The company stated that the mechanism could not be disabled by users, meaning sensitive files were transmitted without explicit consent. This revelation has damaged the reputation of the Chinese AI firm and raised serious concerns among developers who rely on such tools for daily work.

The incident was uncovered on September 18, 2026, when a technical blogger noticed a compressed file pending upload to Alibaba’s cloud storage. While the company claims the data was immediately destroyed, the lack of user control over the upload process has led to widespread criticism. In response, Z.ai has issued an apology, patched the vulnerability, and promised to open-source the codebase to allow for independent verification of its practices.

Default uploads bypass user consent

The core issue was not a malicious hack, but a design choice that prioritized data collection over user privacy. According to reports from Cyber Magazine and the South China Morning Post, the upload function was active out of the box. For a developer, this is a critical trade-off: the tool gains access to the local file system to assist with coding, but in doing so, it created a channel for data exfiltration that the user could not see or stop.

This behavior contrasts sharply with standard expectations for professional software, where data transmission is typically opt-in. By making the upload the default state, Z.ai effectively removed the user's ability to make an informed decision about their own data. This lack of transparency is particularly problematic in corporate environments where intellectual property and credentials are stored locally.

Blogger discovers failed upload attempts

The problem came to light when a Chinese technical blogger inspected a local directory used by ZCode. He discovered a 313MB encrypted file that had failed to upload 564 times, alongside a smaller 15KB file that had successfully reached the server. The larger file appeared to contain a snapshot of a commercial project, deduced from visible filenames within the encrypted package.

The sheer number of failed attempts suggests the system was persistently trying to offload local content, regardless of network conditions or user intent. While the data was encrypted, the act of transferring commercial project files to a third-party cloud service without permission is a severe breach of trust. Other users quickly reported similar experiences, confirming that this was a systemic issue rather than an isolated glitch.

Company promises transparency and compensation

In the aftermath, Z.ai moved to mitigate the damage by apologizing to users and implementing a patch to disable the unauthorized uploads. The company also announced a compensation package involving a weekly quota reset for affected users. Furthermore, Z.ai committed to introducing a data non-retention policy on its model-as-a-service platform, asserting that any uploaded data was immediately destroyed.

However, skeptics point out that claims of immediate destruction are difficult for users to verify independently. This is why the decision to open-source the codebase is significant; it allows third-party reviewers to audit the logic and confirm that no hidden data pathways remain. As AI tools become more deeply embedded in developer workflows, the need for clear access controls and visible behavior is becoming a critical requirement for trust.