Your AI Coding Assistant Has the Keys to the Repo. Z.ai Just Showed Why That Matters

Developers often presume AI coding assistants merely read the files required. However, Z.ai's ZCode assistant took a different approach, packaging the entire workspace and transferring it elsewhere. This led to a public outcry, prompting the company to disable the feature, apologize, and engage external experts to confirm the data had been removed, according to Reuters.

The issue emerged when a Chinese blogger named Ferstar detected unusual disk usage and discovered that ZCode, when active, collected the entire workspace, including the full .git history, Git LFS cache, reflogs, and global app configurations, encrypted the bundle, and uploaded it to Alibaba Cloud's object storage service, Aliyun OSS.

This occurred under a Codebase Indexing feature designed for session checkpoints, version rollbacks, and wiki generation, which was enabled by default. Without a means to disable this feature and a privacy policy that did not clarify the behavior, users were left unaware of the data being transmitted. Chengming Technology reported that six coding workspaces, containing source code, database passwords, and employee personal information, were uploaded.

However, Chengming later retracted its claim without providing further details. Z.ai issued an apology and subsequently deleted the data. Despite this, user satisfaction remained low as the encrypted archives could not be independently verified by the company. In response, Z.ai disabled the upload feature in version 3.14.0, deleted the associated cloud storage, released the assistant built on its GLM-5.3 model as open-source, and introduced zero-data-retention options.

Additionally, Z.ai commissioned security assessments from the China Academy of Information and Communications Technology and cybersecurity firm NSFOCUS, which confirmed that the stored data and the storage bucket had been deleted. Z.ai assured that the data "has never been used for model training" and committed to establishing a product security vulnerability reporting and response process.

While some might consider this a Chinese AI risk, the core issue lies in outdated security architecture. Regardless of the AI component, the software in question is a desktop application with broad file-system access, a background process communicating data, a default setting that can lead to unintended data sharing, and a privacy policy that does not align with the software's actual operations.

The real concern stems from the accessibility of AI coding assistants, which require extensive context to function effectively. They reside within the repository alongside .env files, credentials, commit histories, and potentially sensitive data that was inadvertently committed. As more developers adopt these tools, often without thorough security reviews, this incident highlights the challenges in detecting such breaches.

Experts emphasize the need to treat AI coding assistants as privileged software, subject to rigorous examination. Questions must be asked about what data leaves the machine, when it is stored, where it is kept, and for how long. Default settings should be reviewed to ensure that features like indexing and cloud syncing can be turned off centrally.

Network monitoring is crucial to identify large compressed archives being transferred to external storage locations. Additionally, sensitive information should not be present in repositories, and secret scanning tools combined with vault-based credential management can mitigate potential damage. Open-sourcing the assistant is a step in the right direction, but it is only effective if accompanied by documented data flows and independent audits.

Ultimately, the responsibility lies with DevOps teams to ensure that vendors provide clear information about data handling before installation. The trust issues resulting from this incident will persist until vendors address the gaps between their product functionalities and their communication to users.