Breaking

Z.ai Disables ZCode Features After Unauthorized Repository Upload Reports

September 21, 2026 at 23:34 EDT

Software Dev & Coding
Security
AI Agents

Z.ai has disabled some features of its ZCode AI coding assistant after developers reported that the tool uploaded entire local code repositories to cloud servers without their consent. The Beijing-based company, also known as Zhipu, apologized, said the issue came from a default-on Codebase Indexing feature, and moved to make the product more transparent by open-sourcing ZCode.

Sep. 21, 2026 · Z.ai

ZCode trust test

Z.ai disabled parts of its coding assistant after reports that local repositories were uploaded without clear consent, then open-sourced the client and promised stronger retention controls.

ZCode

coding assistant affected

2 weeks

GLM-5.3 weight-release delay

retention claimed for affected coding use

Cyber benchmark gap

SEC-Bench Pro success rate, shown to scale.

40.4%

GLM-5.3

90.2%

U.S. frontier best

What improved

The client was open-sourced, some features were disabled, and zero-data retention was enabled for developer and enterprise use.

What worried teams

Developers questioned default indexing, lack of clear controls, and the risk that repositories could expose secrets or private IP.

The trust chain

Local repo access

→

Cloud indexing

→

Retention controls

→

Auditable code

Continue reading

The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.