Z.ai disables coding assistant feature after flaw exposed enterprise code upload risk
- Published
- Record updated
Summary
Z.ai disabled several features of its ZCode coding assistant after a default setting was found sending users' local code repositories to Alibaba Cloud servers in China without consent. An independent blogger, Ferstar, reported that the client packaged full workspaces, including .git history and global app configs, and uploaded them to Aliyun OSS. The company removed the feature from its latest release and said it had deleted the associated cloud storage.
Mitigation
Z.ai disabled the repository upload mechanism, deleted the associated cloud storage infrastructure, and implemented changes in the ZCode v3.14.0 client. It also removed the Repo Wiki entry point and the associated generation workflow, and asked CAICT and NSFOCUS to conduct security assessments.