China's Z.ai disables AI coding assistant features after security issue

Chinese startup Z.ai (Zhipu) disabled some features of its ZCode AI coding assistant after users reported it uploaded entire local code repositories to overseas cloud servers without consent. The company said the Codebase Indexing vulnerability was patched, data was deleted, and the GLM-5.3-powered assistant is now open-sourced with zero-data retention.

• ZCode uploaded Git repositories to Alibaba Cloud by default without consent
• Z.ai said the vulnerability was patched and user data deleted
• The GLM-5.3 assistant is open-sourced with zero-data retention enabled
• Chengming Technology retracted its leak claim, citing 'wrong evidence'