Skip to content

All the news that matters, in plain English.

Latest
  1. El Niño ties record intensity months before peak, scientist says
  2. Trump reveals US envoys held three-hour meeting with Iranian delegation at UN
  3. One charge dropped in Alan Jones indecent assault trial as case enters eighth week
  4. NASA welcomes Albania as newest Artemis Accords signatory
  5. Alibaba unveils 'most powerful AI chip in China' and 20GW data centre target
  6. Apple opens 600-capacity Apple Music Hall venue inside Battersea Power Station
  7. British Columbia sues OpenAI over ChatGPT role in Tumbler Ridge school shooting
  8. Andy Burnham seeks resolution to Diego Garcia dispute after call with Mauritius PM

Technology

Z.ai disables coding assistant features after unauthorised code uploads

Beijing AI startup Z.ai has disabled some ZCode features and open-sourced the assistant after users found it uploading code repositories to the cloud without consent.

By Sarah Whitfield · · 1 min read

Chinese AI startup Z.ai said on Monday it had disabled some features of its flagship AI coding assistant after users reported it was uploading entire local code repositories onto overseas cloud servers without their consent.

Beijing-based Z.ai, also known as Zhipu, apologised in a social media post after Chinese developers wrote last week that its ZCode tool had uploaded their code data from Git to Alibaba Cloud. In a statement on Friday, the company said the issue originated from ZCode’s “Codebase Indexing” feature, which was enabled by default, and that it had patched the software vulnerability.

Technology firm Chengming Technology said on Friday that six of its coding workspaces had been uploaded without consent, including complete source code, database passwords and employees’ personal information — then retracted the claim on Monday, saying it had “wrong evidence”. Developers also said there was no toggle to disable the feature and no prior acknowledgement in Z.ai’s privacy policy, and that uploaded files were encrypted with a backend private key held only by Z.ai, leaving them unable to verify deletion themselves.

On Monday Z.ai said it had open-sourced the coding assistant, which runs its latest GLM-5.3 AI model, and disabled certain features. An independent security assessment by the Chinese industry ministry’s affiliated IT standards think tank and cybersecurity firm NSFOCUS found the data had been deleted and was not retained, and Z.ai said it had enabled a zero-data retention feature. “Once again, we sincerely apologize and welcome continued scrutiny from the community,” it said.

Sources

More on this topic: all Technology stories

Get Flip News by email

This opens your email app — we add you manually. No account, no spam, no third parties.