Client version 3.14.0 of Z.ai's ZCode assistant removed the Repo Wiki feature to stop the unauthorized transmission of local repository snapshots to the cloud. Users' entire codebases, including Git history, were previously uploaded to Alibaba Cloud servers by default without notice or an opt out option. An audit by the China Academy of Information and Communications Technology and NSFOCUS confirmed the cloud storage buckets used for these uploads were deleted and no functional path for external file transmission remained.

Z.ai denied that any of the uploaded data was retained or used to train its AI models. The company transitioned ZCode to the Apache 2.0 license on Sept. 21 to increase transparency and is implementing a reward system for developers who report security vulnerabilities. Independent security reviews are currently underway to verify the remediation of the codebase leaks.