AI-generated editorial illustration; not a documentary photograph.
Beijing-based Z.ai, also known as Zhipu AI, has apologised after developers discovered that its ZCode programming platform was uploading user data to external cloud servers without clear consent or a way to disable the mechanism. The incident puts commercial source projects and their Git histories at the centre of questions about how the tool handled developer data.
Project archive found
The issue emerged on Friday when technical blogger Ferstar found encrypted files that had either been uploaded or were awaiting upload to Alibaba cloud servers. File names indicated that one archive contained a snapshot of a commercial project, including its Git history. Ferstar said neither the archive nor the ZCode client could decrypt the file; access required a private key held on Z.ai’s back end.
Default behaviour raised concern
Ferstar reported that uploading was enabled by default and could not be switched off. Other users described similar behaviour. That combination made the incident more consequential than a narrowly isolated diagnostic transfer: developers could have had project material moved outside their expected working environment without an explicit choice at the time of use.
Z.ai said on Friday that it had fixed the issue, apologised to affected users and planned to open-source ZCode while inviting third parties to review it. The company also said the uploaded data had been destroyed immediately. Developers said over the weekend that they had no independent way to verify that claim.
Policy changes and fallout
On Sunday, Z.ai said it would introduce a data non-retention policy for its model-as-a-service platform. The proposed policy would prevent persistent storage of model inputs and outputs, while allowing some data to be retained for API services or legal requirements. That qualification leaves the exact treatment of data in those cases dependent on the service and applicable obligations.
A software engineer at an unnamed Chinese robotics company told the South China Morning Post that the company had banned internal use of Z.ai’s tools because of security concerns. Z.ai’s GLM models can be used through ZCode or competing coding products, including OpenAI’s Codex, so the reported concern may matter beyond ZCode users alone.
Source: Developers Complain After Z.ai’s ZCode Sends Data To Cloud
SIGNAL TITANS
Leave a Reply