A privacy controversy that erupted around Z.AI's AI coding tool has subsided following a series of corrective actions, with the company's shares reversing losses to close in positive territory.

In mid-September, developers on a technical community flagged that ZCode, Z.AI's AI-powered programming tool, was uploading data from some code workspaces and Git history—version information recording code modifications—to the cloud. After an internal review, Z.AI explained that the uploads stemmed from a "code repository indexing" feature that was enabled by default, with the data primarily used to generate documentation for code repositories. This sparked a debate over data boundaries and default settings.

In the days following the uproar, Z.AI took three key steps: it completed remediation and open-sourced ZCode, commissioned security audits from the China Academy of Information and Communications Technology (CAICT) and NSFOCUS with findings made public, and rolled out a "no data content retention" feature on its MaaS platform. Finally, Z.AI issued a public apology, pledging that the code data in question had not been retained and had never been used for model training. The conclusions of both audit institutions corroborated each other, confirming that no related data remained in the cloud. With these remediation and open-source efforts in place, the controversy gradually cooled down.

On the afternoon of September 21, as the corrective actions and open-sourcing took effect, Z.AI (02513.HK) shares rallied, with intraday gains at one point exceeding 3%. By market close, the stock stood at HKD 794.

The Trust Issue

AI coding tools must read the context of code to complete functions, fix bugs, and understand entire projects—a process that occurs locally and is common to all such tools. The question of security lies in whether data leaves the local environment, and if so, what it is used for and how long it is stored. Local reading is analogous to an editor opening a file; once uploaded, data travels over the network into a platform's storage. ZCode drew market scrutiny precisely over the steps taken after data left the local environment.

The disputed "code repository indexing" feature helps the tool understand an entire project across files, and Repo Wiki builds on this to automatically generate documentation for the code repository's structure and purpose. The uploaded data supported these two functions, with the core problem being that the feature was enabled by default, leaving no prior choice for users. Discussions over default settings are nothing new in the software industry. From browser data synchronization to mobile app permission requests, industry standards have tightened through similar debates, and for highly sensitive data, the sector has ultimately gravitated toward fuller disclosure and clearer user consent. Today, users take it for granted that mobile apps seek authorization item by item upon installation—a standard that took years to establish. The requirements for informed consent and choice in coding scenarios are even more stringent.

For businesses integrating AI tools into development workflows, these tools are evolving from coding aids into components of enterprise production systems. How quickly this transition proceeds depends on corporate confidence in data security. External speculation can also be checked point by point against the audit conclusions of the two institutions.

After the controversy escalated, Z.AI's handling unfolded in roughly three phases. On September 18, Z.AI completed an internal review and issued its first response, committing to open-sourcing ZCode, inviting third-party security audits, and resetting weekly quotas for all users. On the evening of September 20, the "no data content retention" feature on the MaaS platform was announced. On September 21, the remediated ZCode was officially open-sourced, with the code published in the zai-org/ZCode repository on GitHub. The remediation was implemented in the new version: ZCode v3.14.0 removed the Repo Wiki feature and its entry point, severing the pipeline that generated and uploaded local repository snapshots. Compared with simply flipping the default from enabled to disabled, removing the feature and its data pipeline altogether represents a more thorough approach.

In the enterprise software sector, third-party security audits are a routine step before a product enters the procurement process. The two institutions involved in this audit were the CAICT, directly under China's Ministry of Industry and Information Technology, whose evaluation conclusions are widely adopted across the ICT industry, and NSFOCUS, a cybersecurity firm with over twenty years of experience. CAICT's technical evaluation found that the zcode-prod Alibaba Cloud OSS storage bucket—the cloud container holding uploaded data—contained zero data in the cloud, and that the v3.14.0 client had completed its security remediation. NSFOCUS's review confirmed that the storage bucket and all data objects within it had been deleted, and that the new client version had no functional path that could trigger local repository snapshots or external file transmission. The two institutions took complementary angles: one verified the current state of the cloud, showing previously uploaded data had been wiped; the other examined the client's functional paths, confirming no new transmission routes existed. On whether data had been retained or used for model training, Z.AI made a written commitment in its announcement: "For the code data mentioned by the community, we commit that no retention has occurred and that it has never been used for model training." Z.AI also apologized to all users and specifically thanked the community developers who identified the issue.

Confidence Endures

On how data is used and where default boundaries are drawn, even leading international vendors have learned similar lessons. In the early days of ChatGPT, numerous overseas banks and large enterprises banned employees from using it until an enterprise version that did not train on commercial data was released. Default settings that used user data for training also drew public debate for both OpenAI and Anthropic, and data retention periods and deletion rights are still contested in overseas litigation. In the wake of the controversy, Z.AI's MaaS platform—the service entry point for enterprises and developers to call Z.AI's models—immediately announced alignment with the strictest overseas "zero data retention" standard, launching the "no data content retention" feature. Once users enable this feature, the platform no longer performs static storage of inputs and outputs from model calls, meaning it does not write them to storage systems for long-term preservation. Data passes through the platform only for the duration of the current computation and is no longer retained once the call ends. This feature has clear boundaries: functions like Batch API and File API, where tasks and files must persist on the platform side, are not covered. Additionally, where laws and regulations require retention, or when investigating suspected violations or abuse, the platform may retain relevant data for 30 days or more as required. Tiered data retention management is already standard practice in overseas enterprise services, while in the domestic market, non-retention options are typically extended only to large clients. Z.AI has opened this option to all users.

In its announcement, Z.AI stated that open-sourcing ZCode would put the code under community oversight, making it open and transparent. It also established a standardized vulnerability reporting mechanism, where developers submit issues, the platform confirms and classifies them, and rewards are paid out based on severity. The long-standing experience of the open-source software industry is that the broader the public review, the sooner flaws are exposed. Linux's ability to sustain global enterprise infrastructure for so long is built precisely on this kind of large-scale mutual inspection.

CITIC Securities believes that after this adjustment, Z.AI will alleviate the usage concerns of many potential enterprise customers, as the most direct worry for corporate clients is whether prompts, model outputs, and related code will linger on the platform side. The firm also anticipates that while this is a crisis remediation in the short term, over the medium to long term it may drive ZCode toward higher transparency standards. For highly sensitive industries adopting external AI services, data handling and retention clauses are typically subject to dedicated compliance reviews; once the zero-retention clause takes effect, review teams gain a clear basis for evaluation. Over the past two years, many enterprises have imposed internal rules on AI tool usage, and it is not uncommon to find policies prohibiting the pasting of core code into external tools. When tool vendors solidify data boundaries, corporate usage policies gain room to relax.

Huatai Securities also commented that the incident's main impact lies at the level of user trust and market sentiment, with Z.AI's core model capabilities and iteration pace unaffected. The increased transparency from open-sourcing significantly reduces the probability of similar risks recurring. Soochow Securities holds a similar view, estimating that the event will have a minimal impact on Z.AI's fundamentals. In procurement practices within government, enterprise, and financial sectors, code audits, penetration testing, and compliance evaluations are standard acceptance procedures. A tool that is open-source, has passed third-party audits, and offers a zero-retention option can be aligned with each of these steps. Any new technology maturing inevitably has imperfections in early versions, and AI coding tools are just entering large-scale use as industry norms take shape. This incident has served as a wake-up call for Z.AI.

Through this round of remediation and open-sourcing, Z.AI has instead taken a major step forward in data security and transparency. The code can be read line by line, and data whereabouts can be verified at any time—few companies in the industry have reached this level. As large models deepen their integration with enterprise production systems, Z.AI, having laid a solid trust foundation through this ordeal, is worth watching in the future.