Z.ai Faces Reputation Damage After ZCode Uploads User Data Without Consent
Z.ai, or Zhipu AI, is in hot water after users discovered that its ZCode tool was improperly uploading local files to a cloud service. This issue came to light on Friday, thanks to a tech blogger named Ferstar, who found a 313-megabyte file waiting to upload to Alibaba's cloud, along with 564 failed attempts to do so. A smaller 15-kilobyte file had actually been sent. Ferstar noted both files were encrypted, and the larger one seemed to contain sensitive information from a commercial project he worked on, including its Git history. He highlighted that neither he nor ZCode could access the archive, as it needed a private key from Z.ai. A developer from Shanghai criticized this as theft, raising serious concerns about the intent. While Z.ai apologized and patched the issue, developers worry this could tarnish their reputation, especially with growing cybersecurity importance in AI.
Key facts
- Z.ai, also known as Zhipu AI, is a Chinese AI company
- Users discovered ZCode was uploading local files to cloud storage without authorisation
- The issue came to light on Friday when blogger Ferstar inspected a local directory in ZCode
- A 313-megabyte compressed file was pending upload to Alibaba Group Holding's cloud storage service after failing 564 times
- A smaller 15-kilobyte file had been successfully sent
- Both files were encrypted, and the larger one contained a snapshot of a commercial project including its Git history
- The archive could be decrypted only with a private key held on Z.ai's back end
- A Shanghai-based AI developer said the incident was like stealing from users and cited malicious intent as the concern
- Z.ai apologised and patched the vulnerability, but developers said its reputation would likely suffer
Entities
Artists
- Ferstar
Institutions
- Z.ai
- Zhipu AI
- Alibaba Group Holding
Locations
- Shanghai
- China