Z.ai silently uploaded devs' local data: 313MB and 564 upload attempts

Developers found that Z.ai's (Zhipu AI) ZCode tool compressed and sent local files to Alibaba Cloud storage without consent. The company apologized, said it fixed the issue and destroyed uploaded data, and promised to open-source ZCode for third-party review.

• ZCode compressed 313MB of a developer's files and tried to upload the archive 564 times
• A smaller 15KB file was successfully exfiltrated, with filenames still visible
• The upload mechanism is enabled by default with no off switch
• Z.ai promises to open-source ZCode and invite third-party auditors