{"id":5121,"date":"2026-09-23T12:29:39","date_gmt":"2026-09-23T12:29:39","guid":{"rendered":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/2026\/09\/23\/your-ai-coding-assistant-has-the-keys-to-the-repo-z-ai-just-showed-why-that-matters\/"},"modified":"2026-09-23T12:29:39","modified_gmt":"2026-09-23T12:29:39","slug":"your-ai-coding-assistant-has-the-keys-to-the-repo-z-ai-just-showed-why-that-matters","status":"publish","type":"post","link":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/2026\/09\/23\/your-ai-coding-assistant-has-the-keys-to-the-repo-z-ai-just-showed-why-that-matters\/","title":{"rendered":"Your AI Coding Assistant Has the Keys to the Repo. Z.ai Just Showed Why That Matters"},"content":{"rendered":"
\"\"<\/div>\n

\"\"<\/p>\n

Most developers who install an AI coding assistant assume it reads the files it needs. Few expect it to package the entire workspace and ship it somewhere else.<\/span><\/p>\n

That\u2019s what users say happened with ZCode, the AI coding assistant from Chinese AI company Z.ai, also known as Zhipu. After a week of public backlash, the company disabled the features involved, apologized, and brought in outside firms to confirm the data was gone, Reuters reported.<\/span><\/p>\n

The trouble surfaced when an independent Chinese blogger who goes by Ferstar noticed abnormal disk usage and traced it to ZCode background processes. He found that whenever a user was logged in, ZCode packaged the entire workspace, including the full .git history, Git LFS cache, reflogs and global app configs. It then encrypted the bundle and uploaded it to Aliyun OSS, Alibaba Cloud\u2019s object storage service.<\/span><\/p>\n

The source was a Codebase Indexing feature that supported session checkpoints, version rollbacks, and wiki generation. It was on by default. According to Reuters, there was no toggle to turn it off, and the privacy policy didn\u2019t disclose the behavior. The archives were compressed and encrypted with keys held only on Z.ai\u2019s servers, so users couldn\u2019t see what had left their machines.<\/span><\/p>\n

One company, Chengming Technology, said six coding workspaces had been uploaded, including source code, database passwords and employee personal information. It later retracted the complaint, citing \u201cwrong evidence,\u201d without further explanation.<\/span><\/p>\n

Z.ai apologized on Friday and said it had deleted the data. Many users weren\u2019t satisfied. Because the archives were encrypted with the company\u2019s own key, nobody outside Z.ai could verify that claim.<\/span><\/p>\n

On Monday, the company went further. It disabled the upload mechanism in ZCode version 3.14.0, deleted the related cloud storage, open-sourced the assistant built on its GLM-5.3 model, and added zero-data-retention options. It also commissioned security assessments from the China Academy of Information and Communications Technology, a think tank affiliated with China\u2019s industry ministry, and cybersecurity firm NSFOCUS. Z.ai said NSFOCUS confirmed that the stored data and the storage bucket itself had been deleted. Z.ai said the data \u201chas never been used for model training\u201d and pledged to \u201cestablish an ongoing product security vulnerability reporting and response process.\u201d<\/span><\/p>\n

It\u2019s tempting to file this under \u201cChinese AI risk\u201d and move on. That would miss the point.<\/span><\/p>\n

This isn\u2019t an AI model problem. It\u2019s an old security architecture problem. Take away the AI, and you have a desktop app with broad file-system access, a background process that phones home, a default-on setting, and a privacy policy that didn\u2019t match what the software did. What\u2019s different now is access. AI coding assistants need deep context to be useful. So they sit inside the repository, next to .env files, credentials, commit history, and the customer data someone committed by mistake three years ago. And developers are adding these tools fast, often before security has signed off.<\/span><\/p>\n

That\u2019s what made this incident hard to spot. Mitch Ashley, vice president and practice lead for CIO & technology buyers and software lifecycle engineering at The Futurum Group<\/a>, points to the timing. \u201cThe workspace uploads came to light because an independent blogger traced abnormal disk usage to a background process, well after developers had installed the tool,\u201d he said.<\/span><\/p>\n

The lessons here apply to every AI coding tool, no matter where the vendor is based.<\/span><\/p>\n

First, treat coding assistants as privileged software. They deserve the same review as any agent with access to source code and secrets. Ask vendors exactly what leaves the machine, when, where it\u2019s stored, and for how long. Second, check the defaults. Indexing, cloud sync, and \u201cmemory\u201d features are often on out of the box because they make the product work better. Teams need to know which ones are active and whether they can be turned off centrally.<\/span><\/p>\n

Third, watch the network. Egress monitoring on developer workstations should flag large compressed archives heading to an outside storage bucket. Fourth, keep secrets out of repos. Database passwords sitting in a workspace are a problem whether an AI tool uploads them or not. Secret scanning and vault-based credential management limit the damage when something like this happens.<\/span><\/p>\n

Finally, favor tools you can verify. Z.ai\u2019s decision to open-source ZCode came late, but it\u2019s the right direction. Open code, documented data flows and independent audits give security teams something to check instead of something to trust.<\/span><\/p>\n

For many companies, source code is their most valuable intellectual property. Having it land in a third party\u2019s cloud without anyone deciding to send it is a business risk, not just a technical one. And deleting the data doesn\u2019t settle every question. Ashley raises the one that remains open. \u201cBut has anyone answered the question of where those codebases went while in the cloud and how they were used?\u201d<\/span><\/p>\n

That risk will grow as coding assistants turn into agents that run commands, open pull requests, and act on their own. The more a tool can do, the more it can do by accident.<\/span><\/p>\n

Z.ai\u2019s eventual response covered the right steps: disable, delete, verify, open up. But the trust damage happened in the gap between what the product did and what users were told. DevOps teams can\u2019t close that gap for vendors. They can make sure they ask the right questions before installing the next assistant.<\/span><\/p>\n

Read More<\/a><\/p>\n

\u200b<\/p>","protected":false},"excerpt":{"rendered":"

Most developers who install an AI coding assistant assume it reads the files it needs. Few expect it to package […]<\/p>\n","protected":false},"author":1,"featured_media":5122,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[5],"tags":[],"class_list":["post-5121","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-devops"],"_links":{"self":[{"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/posts\/5121","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/comments?post=5121"}],"version-history":[{"count":0,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/posts\/5121\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/media\/5122"}],"wp:attachment":[{"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/media?parent=5121"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/categories?post=5121"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/tags?post=5121"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}