{
  "id": 9163616,
  "title": "Z.ai says sorry for slurping up your code, open sources ZCode",
  "url": "https://urgent.news/2026/09/22/z-ai-says-sorry-for-slurping-up-your-code-open-sources-zcode-9163616",
  "topic": "ai",
  "section": "AI",
  "published": "2026-09-22T15:59:00.000Z",
  "source": {
    "name": "The Register",
    "slug": "the-register",
    "url": "https://www.theregister.com/security/2026/09/22/zai-says-sorry-for-slurping-up-your-code-open-sources-zcode/5298300"
  },
  "original_language": "en",
  "account": "Chinese AI company Z.ai has issued an apology after its code-generation assistant, ZCode, was found to be automatically uploading users' workspaces to Alibaba Cloud storage without their consent. This behavior closely resembles the controversy that Elon Musk's xAI faced in July regarding the same issue. ZCode packaged and git-encrypted entire user workspaces, including complete project histories, and sent them to the cloud. The private key used to decrypt the data was held only by the company's server, preventing users from accessing or deleting the files. Z.ai's researcher Ferstar discovered the issue, stating there were no options for users to disable the behavior or any disclosure in ZCode's privacy policy. The problem stemmed from the tool's Repository Index functionality, which automatically uploaded files after Repo Wiki generated pages in the cloud. ZCode has apologized for the security issues and confirmed that the uploaded data was never used to train its models. The company stated that it will establish an ongoing product security vulnerability reporting and response process and welcomes continued scrutiny from the community. ZCode has already removed the Repo Wiki feature and open sourced the entire project on GitHub for community review.",
  "summary": "China’s AI darling goes on the defense after engineer highlighted Grok-esque security flaws",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}