Z.ai has apologised after developers discovered that its ZCode programming tool packaged entire user workspaces, including project histories, encrypted them and uploaded them to Alibaba Cloud. The incident raised serious privacy and security concerns because users could neither access nor delete the files, while the practice was allegedly not disclosed or optional.

ZCode said the data had not been used to train its models and claimed external reviews found that all previously uploaded material had been deleted after the Repository Index feature was removed. It has open-sourced the project and promised a vulnerability-reporting process, although researcher Ferstar criticised the company for deleting commit history and pre-patch upload code. Z.ai, formerly Zhipu, is a major Chinese AI company that recently became the first post-generative-AI Chinese firm to list on Hong Kong’s stock exchange.