> ## Content Index
> Fetch the complete content index at: https://www.metatalks.ai/llms.txt
> Use this file to discover other available public pages before exploring further.

# Z.ai disables coding assistant features after an unauthorized cloud upload of users' code repositories
- URL: https://www.metatalks.ai/z-ai-disables-coding-assistant-features-after-unauthorized-cloud-upload/
- Published: 2026-09-23T14:03:00.000Z
- Updated: 2026-09-23T14:02:59.000Z
- Author: Al
- Tags: News, AI Security, Privacy, #newswire

**Z.ai traced the uploads to an indexing feature switched on by default, which developers say they had no way to turn off.**

Z.ai, the Beijing lab also known as Zhipu, apologized on September 21 and said it had disabled some features of ZCode, its coding assistant, after developers found the tool uploading their local code to Alibaba Cloud without consent. [Reuters](https://www.reuters.com/legal/litigation/chinas-zai-disables-ai-coding-assistant-features-after-security-issue-2026-09-21/?ref=metatalks.ai) called it a rare public security disclosure by a Chinese AI lab.

Developers in China raised the alarm on September 18 in posts on X and the Chinese platform RedNote. They said the tool was sending whole code repositories, that the uploading could not be stopped and that Z.ai's privacy policy had never mentioned it. Caixin reported that the uploads included full version histories.

That afternoon Z.ai named Codebase Indexing, enabled by default, as the cause, saying it had patched the flaw and deleted the data. The copies, however, were encrypted with a private key only Z.ai holds, so the developers could not open their own uploaded files. Nor could they independently confirm the deletion.

Three days later, Z.ai said it had switched ZCode to zero data retention and open-sourced the assistant, which runs on its GLM-5.3 model. According to the company, the cybersecurity firm NSFOCUS and an IT standards think tank under China's industry ministry independently checked the cloud platform and found the code deleted. Z.ai has promised to publish their full assessment.