conv.

All stories
AIQuiet 6d · day 6

Z.AI admits ZCode silently uploaded user files without consent

China's second-largest AI company apologized after developers discovered its coding assistant exfiltrated 313MB of workspace data to Alibaba Cloud.

newest coverage 6d agosummary written 5d ago2 pieces Newswires

What to know

  • Z.AI's ZCode coding assistant secretly compressed and attempted to upload 313MB of user workspace files to Alibaba Cloud 564 times without consent or user awareness.
  • The upload mechanism was enabled by default with no user option to disable it; filenames remained visible despite file encryption, potentially exposing sensitive project details.
  • Z.AI apologized and claims to have fixed the issue, but a Chinese robotics firm has already banned Z.AI tools internally due to security concerns.
  • The company pledged to open-source ZCode's codebase for independent third-party review to rebuild trust.

“On Friday, it apologized and said it had fixed the uploading of user files and data without consent. Moreover, it has been assuring users that any data uploaded to its cloud service has been destroyed.”

Z.AI (via reporting) · Tom's Hardware ↗

Z.AI (Zhipu AI) AI company, ZCode developerFerstar Developer/bloggerFeng Ruohang Tech blogger

Z.AI admits ZCode silently uploaded user files without consent
tomshardware.com

How it unfolded 2 developments, newest first · click a bar or a number to jump articles

Peak 1 piece in two hours at Sep 21, 7 AM; 2 pieces over 6 days (2 articles) Sep 21, 7 AM — 1 piece · 1 article — Newswires 1Sep 21, 9 AM — 1 piece · 1 article — Newswires 1Sep 21, 11 AM — quietSep 21, 1 PM — quietSep 21, 3 PM — quietSep 21, 5 PM — quietSep 21, 7 PM — quietSep 21, 9 PM — quietSep 21, 11 PM — quietSep 22, 1 AM — quietSep 22, 3 AM — quietSep 22, 5 AM — quietSep 22, 7 AM — quietSep 22, 9 AM — quietSep 22, 11 AM — quietSep 22, 1 PM — quietSep 22, 3 PM — quietSep 22, 5 PM — quietSep 22, 7 PM — quietSep 22, 9 PM — quietSep 22, 11 PM — quietSep 23, 1 AM — quietSep 23, 3 AM — quietSep 23, 5 AM — quietSep 23, 7 AM — quietSep 23, 9 AM — quietSep 23, 11 AM — quietSep 23, 1 PM — quietSep 23, 3 PM — quietSep 23, 5 PM — quietSep 23, 7 PM — quietSep 23, 9 PM — quietSep 23, 11 PM — quietSep 24, 1 AM — quietSep 24, 3 AM — quietSep 24, 5 AM — quietSep 24, 7 AM — quietSep 24, 9 AM — quietSep 24, 11 AM — quietSep 24, 1 PM — quietSep 24, 3 PM — quietSep 24, 5 PM — quietSep 24, 7 PM — quietSep 24, 9 PM — quietSep 24, 11 PM — quietSep 25, 1 AM — quietSep 25, 3 AM — quietSep 25, 5 AM — quietSep 25, 7 AM — quietSep 25, 9 AM — quietSep 25, 11 AM — quietSep 25, 1 PM — quietSep 25, 3 PM — quietSep 25, 5 PM — quietSep 25, 7 PM — quietSep 25, 9 PM — quietSep 25, 11 PM — quietYesterday, 1 AM — quietYesterday, 3 AM — quietYesterday, 5 AM — quietYesterday, 7 AM — quietYesterday, 9 AM — quietYesterday, 11 AM — quietYesterday, 1 PM — quietYesterday, 3 PM — quietYesterday, 5 PM — quietYesterday, 7 PM — quietYesterday, 9 PM — quietYesterday, 11 PM — quietToday, 1 AM — quietToday, 3 AM — quietToday, 5 AM — quietToday, 7 AM — quietToday, 9 AM — quiet 1–2
Sep 22Sep 23Sep 24Sep 25yesterdaynow · 11:50 AM ET
  1. 1

    Chinese robotics company bans Z.AI tools over security concerns

    An unnamed software engineer at a leading Chinese robotics company disclosed that Z.AI's tools have been internally banned due to security concerns, signaling organizational loss of trust in the platform.

  2. 2

    Developers report Z.AI's ZCode uploading local files without consent

    Prominent developers Ferstar and Feng Ruohang publicly raised alerts about ZCode silently compressing and uploading their local workspace files to Alibaba Cloud storage without authorization. Ferstar's analysis showed 313MB of files compressed into an archive with 564 failed upload attempts and one successful 15KB transfer; filenames remained visible despite encryption, exposing project details.

    “ai 's firefighting exercise began after a number of prominent devs raised flags about their local files and data being uploaded to online servers without their consent.”
    — Tom's Hardware · source
    1. 1 outlet Devs say Chinese AI company silently uploaded hundreds of megabytes of local workspace data, company apologizes — Z.AI, the firm behind the GLM models, didn’t ask for user consent and made 564 attempts to exfiltrate 313MB archive

      first by Tom's Hardware, 6d ago

  3. background

    Z.AI apologizes and claims to have fixed the upload issue — Z.AI publicly addressed the security concerns, apologizing for the unauthorized file uploads and stating it had fixed the problem. The company assured users that data uploaded to its cloud service had been destroyed and announced plans to open-source ZCode's codebase and invite third-party reviewers to assess it.