Chinese AI company Z.ai disabled parts of its ZCode coding assistant after developers reported that local repositories were being uploaded to cloud infrastructure without the consent they expected. The company apologised, said the affected codebase-indexing feature had been patched and promised a continuing product-security response process. A repository can contain much more than source files. Configuration, internal documentation, environment files and credentials may sit beside ordinary application code. That makes repository indexing a privileged function. Developers need to know what leaves the machine, where it is processed and how long it remains available.
Default settings made the incident more serious
Reporting on the incident says Codebase Indexing was allowd by default and sent repository material to Alibaba Cloud. The issue was discovered by developers rather than through a public product notice. Z.ai’s decision to disable the feature limits further exposure while the company reviews the implementation. The episode shows why coding assistants need stronger data boundaries than ordinary desktop utilities. A tool that can inspect an entire project is useful precisely because it has broad visibility. That same visibility becomes a liability when transfers happen in the background. Enterprise customers will also look for audit logs, regional processing options, directory exclusions and clear retention rules. A patch fixes the immediate behaviour, but restoring confidence requires making the product’s data path understandable before a developer connects a sensitive repository. Z.ai’s response is now part of the story. The company says it has fixed the problem and will maintain a product-security reporting process. Developers will judge that commitment through future releases, documentation and whether privacy controls become explicit defaults rather than settings users must discover after installation.The incident is particularly relevant to coding agents because developers often work with repositories that were never intended to leave a company’s own infrastructure. A project can include customer information, proprietary algorithms, internal APIs and deployment credentials alongside ordinary application code. Indexing the whole repository is convenient, but the data boundary has to be explicit.
The response also shows a broader problem with defaults. Developers tend to accept recommended settings, especially when an AI tool is marketed as a productivity assistant. If a feature can transmit project data, the product should make that fact obvious before the first upload rather than burying it in documentation.
Z.ai’s decision to disable the feature while it investigates is a useful containment step. The longer-term test will be whether the company provides clearer controls and documentation and whether similar behaviour is prevented elsewhere in the product. For coding agents, trust is becoming part of the product specification, not an optional extra.
There is also a business issue for AI coding companies. Developers may accept cloud processing for a public project but reject it for an internal repository. The product So needs to distinguish between those environments instead of treating all source code as ordinary input.
Privacy settings need to be visible at the moment a repository is connected. A documentation page that explains the behaviour after installation is not enough when a coding agent can immediately inspect hundreds or thousands of files.
The ZCode episode is likely to be watched by developers choosing between coding agents. Speed matters, but so do data residency, local processing and the ability to disable indexing. Those factors are becoming part of the normal evaluation checklist for developer AI.