Z.ai data breach exposes cloud-sync and key-management risks for AI coding tools

Zhipu AI, the company behind the GLM model series, is facing a trust crisis after its coding assistant ZCode was discovered silently uploading local workspace files to Alibaba Cloud without explicit user consent. An independent technical blogger found that a 313 MB encrypted archive containing a commercial project's Git history was pending upload after 564 failed attempts, while a 15 KB file had already been transmitted. The archive could be decrypted only with a private key held on Z.ai's backend, according to the SCMP report. Z.ai apologized and patched the vulnerability, but the incident raises serious questions about data handling in AI development tools.

What a coding assistant sent to the cloud

The blogger, known as Ferstar, inspected a local directory in ZCode and noticed a compressed file destined for Alibaba Cloud storage that had failed to upload 564 times. A smaller file had already made it through. The filenames indicated the archive contained a snapshot of a commercial project, including the project's Git history. Encryption made the content inaccessible to Ferstar acting alone, but the decryption key was held on Z.ai's servers. The company responded by fixing the vulnerability and apologizing, as noted in the SCMP article, but developers warned the incident would damage trust at a time when AI security is under scrutiny.

Why builders should pay attention

Encryption alone does not protect sensitive code if the decryption key lives on a vendor's backend and that backend is compromised or misconfigured. ZCode's behavior of silently uploading workspace artifacts without showing users what data is leaving their machine is a red flag for any team handling proprietary code, internal tools, or client projects. This Z.ai data breach shows that even encrypted uploads can expose project history, commit messages, and configuration files if the key holder is untrusted or exposed. The incident also spotlights cloud sync workflows: when an AI coding assistant integrates with cloud storage, users lose visibility into what is being copied and stored.

What changes in practice

Teams evaluating or using AI coding assistants should audit data handling policies and look for tools that provide transparent, user-controlled sync mechanisms. Z.ai's patch addresses the specific vulnerability, but the underlying pattern of client-side data being pushed to vendor-managed storage remains common across many AI coding tools. Developers should demand clear consent flows, local-only processing modes, and mechanisms to verify what data leaves their environment. The SCMP report notes that the incident reinforces the importance of robust key management, tamper-evident storage, and prompt incident response.

Caveats and open questions

The evidence comes almost entirely from a single SCMP report. Further details may emerge about the scope of affected users, whether any decrypted data was actually accessed by unauthorized parties, and whether Z.ai's backend security measures were adequate before the patch. Independent verification would strengthen confidence in the conclusions.