The AI coding tool ZCode transmitted full local repositories to remote servers without user consent before Zai shut down the affected features. The company uploaded these codebases by default to Alibaba Cloud servers without providing a notice or an opt out mechanism. Remediation in the ZCode v3.14.0 client removed the Repo Wiki feature and blocked the generation of local repository snapshots.

Zai placed the ZCode project under an Apache 2.0 license to allow for community oversight after developers reported the security flaws on social media. Assessments by NSFOCUS and the China Academy of Information and Communications Technology verified that all data objects in the Alibaba Cloud OSS bucket were deleted. The company confirmed that none of the transmitted data was used to train its models.