ZCode AI Coding Assistant Reportedly Uploaded Local Code Repositories Without Consent
ZCode AI
An AI coding assistant uploaded local developer repositories to cloud storage without consent due to a default-enabled indexing feature. The developer patched the issue and disabled the upload path.
- fix status
- Fix status unknown
- first report
- 18 Sep 2026
- last update
- 18 Sep 2026
Timeline · 1
Sources · 1
Research and catalogues
- 2026-09-18Z.ai's ZCode AI Coding Assistant Reportedly Uploaded Developers' Local Code Repositories to Alibaba Cloud Without ConsentAI Incident Database · incidentdatabase.ai/cite/1714
Titles and links belong to their publishers. The summary above is written by gcdRadar in its own words; data is CC BY-SA 4.0.
Classification
- lane
- Patch now
- AI role
- Attack on AI
- categories
- Data leak
- severity
- 2 · Disclosed vulnerability
- fix status
- Fix status unknown
- targets
- Framework / tooling
- owasp llm top 10
- LLM02:2025 Sensitive Information Disclosure
- mitre atlas
- no technique for these categories
- dates
- happened 18 Sep 2026 · first reported 18 Sep 2026
- origin
- AI Incident DatabaseDerived from the AI Incident Database (CC BY-SA 4.0).
- record
- confidence 0.90 · created 2026-10-18 06:33Z · updated 2026-10-18 06:59Z
Lane, AI role, categories and severity come from the classifier; the OWASP and ATLAS rows are derived from the categories. How these are assigned
Copy a brief
This record as a short Markdown brief, for a ticket, a chat or a coding agent.
the brief as text
# ZCode AI Coding Assistant Reportedly Uploaded Local Code Repositories Without Consent https://gcdradar.vercel.app/incidents/zcode-ai-coding-assistant-reportedly-uploaded-local-code-rep · AIR-2026-0391 · closed 2026-10-02 - Lane: Patch now - Severity: 2 (Disclosed vulnerability) - Fix status: Fix status unknown - First reported: 2026-09-18 - AI role: Attack on AI - Products: ZCode AI ## Summary An AI coding assistant uploaded local developer repositories to cloud storage without consent due to a default-enabled indexing feature. The developer patched the issue and disabled the upload path. ## What to do No action recorded; read the sources below and the vendor's advisory. ## Latest updates - 2026-09-18: Z.ai's ZCode AI Coding Assistant Reportedly Uploaded Developers' Local Code Repositories to Alibaba Cloud Without Consent (https://incidentdatabase.ai/cite/1714) ## Sources - 2026-09-18 AI Incident Database: Z.ai's ZCode AI Coding Assistant Reportedly Uploaded Developers' Local Code Repositories to Alibaba Cloud Without Consent https://incidentdatabase.ai/cite/1714 Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.
Related
- closed7.1Open WebUI CVE-2026-109293: Open WebUI Tool Source Code Information Disclosure
Patch now · Disclosed · since 12 Oct 2026 · CVE-2026-109293
AI - closed5.3Open WebUI CVE-2026-109296: Open WebUI missing authorization exposes disabled model backends
Patch now · Disclosed · since 12 Oct 2026 · CVE-2026-109296
AI - closed7.6Open WebUI CVE-2026-109292: Open WebUI information disclosure leaks session cookies to OAuth servers
Patch now · Disclosed · since 12 Oct 2026 · CVE-2026-109292
AI - closed5.3Open WebUI CVE-2026-109287: Open WebUI knowledge base authorization flaw exposes folder metadata
Patch now · Disclosed · since 12 Oct 2026 · CVE-2026-109287
AI - closed6.0LangChain family CVE-2026-106119: LangChain MongoDBChatMessageHistory Query Injection
Patch now · Disclosed · since 6 Oct 2026 · CVE-2026-106119
AI - closed7.1Langflow CVE-2026-105699: Langflow Authenticated Cross-Project File Disclosure
Patch now · Disclosed · since 5 Oct 2026 · updated 7 Oct 2026 · CVE-2026-105699
AI