AIBRIEF
Z.ai, a Chinese AI firm also known as Zhipu AI, apologised after an independent researcher found its developer tool ZCode queueing user files for cloud upload.
A Chinese AI startup's coding assistant tried to upload an encrypted 313-megabyte archive of a user's commercial project to Alibaba Cloud on Friday, failing 564 times before the user noticed. A separate 15-kilobyte file had already been sent. The company has apologised and pushed a patch.
Z.ai, also known as Zhipu AI, runs ZCode, an agentic coding IDE aimed at developers. Independent Chinese technical blogger Ferstar discovered the queued uploads while inspecting a local directory and posted the finding on X. The destination was Aliyun OSS, Alibaba Group's cloud storage service.
Both files were encrypted, and Ferstar and the ZCode client could not open them. Only Z.ai's backend held the private key. The larger archive contained a snapshot of a commercial project, including its Git history. Independent technical verification is available via the yizeyi18/zcode-upload-verify GitHub repository, and a Shanghai-based AI developer told SCMP the behaviour amounted to "stealing something from users" and flagged "malicious intent" as the concern.
Z.ai has apologised and shipped a patch, but has not publicly explained what the uploads were for. It is also unclear whether the upload target was hard-coded or user-configurable, and how many users were affected.