Chinese artificial intelligence company Z.ai has issued an apology after developers discovered its code-generation tool was collecting and transmitting entire user workspaces to cloud storage without permission. The incident, reported Monday by The Register, mirrors security issues that plagued Elon Musk's xAI earlier this year. Z.ai is among China's most prominent AI startups and the first pure-play AI company to go public on the Hong Kong Stock Exchange in the generative AI era.
The company's ZCode tool was found packaging and encrypting complete user workspaces, including full project histories, and sending them to Alibaba Cloud. The private key needed to decrypt the uploaded files was held exclusively by Z.ai's server, preventing users from accessing or deleting their own data. Ferstar, the researcher who first exposed the problem, said users had no way to turn off this behavior in their settings, and ZCode's privacy policy didn't disclose the practice. The issue stemmed from the tool's Repository Index functionality, which triggered file uploads after Repo Wiki generated pages in the cloud.
In its Monday statement, Z.ai confirmed the uploaded data was never used to train its models and thanked community developers who identified the security flaws. The company said it would "establish an ongoing product security vulnerability reporting and response process" and offer rewards based on issue severity. Z.ai hired the China Academy of Information and Communications Technology and Beijing security firm NSFOCUS to examine its product after making changes, and both assessments concluded that all previously uploaded data has been deleted and the Repo Wiki feature was removed. The company also open sourced the entire project on GitHub to put "the code under community scrutiny."
The security lapse is particularly notable given Z.ai's prominence in China's AI sector. The startup spun out of Tsinghua University's Knowledge Engineering Group research lab in 2019 and has positioned itself as competing with Western AI leaders. Last month, the company claimed its GLM-5.3 model matches the most advanced systems from Anthropic and OpenAI at finding security vulnerabilities. Z.ai has also said it built the first advanced model entirely on Chinese hardware from Huawei. Ferstar confirmed the open sourced code no longer contains the Repo Wiki feature but criticized Z.ai for erasing commit records and the original source code that handled file uploads before the fix.
The incident arrives as Z.ai faces growing scrutiny from Western competitors and governments. Anthropic and OpenAI have reportedly raised concerns about the capabilities of models from Z.ai and fellow Chinese startup Moonshot, while the US government considers restricting access to these systems. For developers using AI coding assistants, the episode highlights the need to verify what data these tools collect and where it goes. Companies building trust in AI tools can't afford to treat user code as a resource to extract without clear disclosure, and Z.ai's decision to open source ZCode may set a precedent for how AI firms rebuild credibility after privacy failures. The security landscape for AI development tools remains uneven, and decision-makers evaluating these platforms should weigh transparency commitments against the operational risks of opaque data handling practices.