Z.ai has removed the default‑on Codebase Indexing feature in its ZCode AI coding assistant, deleted the associated Aliyun OSS bucket, and released the assistant’s code under an open‑source licence while adding a zero‑data‑retention option. The change follows a public outcry after the tool automatically packaged full developer workspaces—including Git history, LFS cache, reflogs and local configuration—and uploaded them to a cloud storage bucket without a user‑controllable toggle.
What changed in the ZCode AI coding assistant
The assistant’s background process would, whenever a user was logged in, create an encrypted archive of the entire workspace and push it to Alibaba Cloud’s Object Storage Service. This behaviour was driven by a "Codebase Indexing" feature that supported session checkpoints, version rollbacks and wiki generation. The feature was enabled by default, had no visible off switch, and was not disclosed in the privacy policy. After the issue was highlighted by an independent blogger who observed abnormal disk usage, Z.ai disabled the upload mechanism in version 3.14.0, removed the storage bucket, and announced that the data had been deleted. The company also engaged the China Academy of Information and Communications Technology and the cybersecurity firm NSFOCUS, which confirmed the deletion. Z.ai further stated that the uploaded data was never used for model training and introduced a zero‑data‑retention mode.
Why the behavior matters to AI and cloud engineers
AI coding assistants need deep access to source files to generate useful suggestions. When that access is coupled with automatic, undisclosed data export, the tool becomes a privileged component that can exfiltrate intellectual property and secrets. The incident shows that even a desktop‑level assistant can act as a data‑exfiltration vector if default settings are not scrutinised. For engineers responsible for platform security, the case highlights a gap between vendor‑claimed behaviour and actual data flows, which can undermine compliance and risk‑management programmes.
Architectural and operational implications
- Privilege level assessment: Treat any AI coding assistant as a privileged agent that can read the full file system, including hidden Git metadata and credential files.
- Configuration visibility: Verify whether features such as indexing, cloud sync or session checkpoints are enabled by default and whether they can be disabled centrally.
- Network egress monitoring: Implement alerts for large, compressed uploads from developer workstations to external endpoints, especially to object‑storage services.
- Secret management: Keep database passwords and other credentials out of source repositories; use secret‑scanning tools or vault‑based storage to limit exposure.
- Supply‑chain transparency: Prefer tools with open‑source components or documented data‑flow diagrams that can be independently audited.
Related CloudNinjas coverage: security.
What This Means For Practitioners
Before adopting an AI coding assistant, conduct a security review that asks: what data leaves the machine, where it is stored, and for how long? Ensure that any indexing or cloud‑sync capabilities are disabled unless explicitly required, and verify that the vendor provides a way to turn them off. Deploy egress monitoring to catch unexpected large uploads, and enforce secret‑scanning policies to keep credentials out of the codebase. Finally, favour solutions that expose their code and data‑handling processes for independent verification, as the open‑source release from Z.ai demonstrates a path toward greater trust.