Z.ai denied that any of the uploaded data was retained or used to train its AI models. The company transitioned ZCode to the Apache 2.0 license on Sept. 21 to increase transparency and is implementing a reward system for developers who report security vulnerabilities. Independent security reviews are currently underway to verify the remediation of the codebase leaks.
Wednesday, October 21, 2026
Story
Z.ai Open Sources ZCode After Default Codebase Uploads to Alibaba Cloud
Cybersecurity28 days ago
Client version 3.14.0 of Z.ai's ZCode assistant removed the Repo Wiki feature to stop the unauthorized transmission of local repository snapshots to the cloud. Users' entire codebases, including Git history, were previously uploaded to Alibaba Cloud servers by default without notice or an opt out option. An audit by the China Academy of Information and Communications Technology and NSFOCUS confirmed the cloud storage buckets used for these uploads were deleted and no functional path for external file transmission remained.
Looking for more context or analysis?
Tilt chat provides reliable, tailored insights, alerts, and automations.