Experts warn default-on data collection is industry-wide practice in AI coding tools after ZCode privacy controversy

A privacy dispute over "code uploading" has thrust Chinese AI giant Zhipu (2513.HK) into the center of public scrutiny.

Allegations of Silent Data Uploads

Social media reports alleged that Zhipu's AI-powered coding tool, ZCode, was uploading users' programming development data to third-party cloud servers without their consent. A tech blogger claimed that once a user logged into their ZCode account, the software would automatically package and encrypt the entire project workspace—along with complete background information folders—and upload it to the cloud. The packaged files, according to the blogger, contained "almost entirely core assets."

Some developers also reported that even after manually disabling the data upload toggle in ZCode's settings, the background process continued to upload data.

Zhipu's Response and Apology

The incident sparked widespread concern among developers. On September 18, Zhipu quickly issued a statement in response. The company explained that the data privacy controversy stemmed from a feature called "Code Repository Indexing," which had been enabled by default since its launch. Zhipu stated that the uploaded data was used solely to generate a RepoWiki (code repository knowledge base) page in the cloud and was subsequently destroyed without being retained.

The company apologized to affected users and announced that it would open-source the ZCode codebase.

On September 21, a reporter from The Paper exclusively learned that ZCode had officially been made open-source. Following the rectification of the previously exposed issues, Zhipu invited the China Academy of Information and Communications Technology (CAICT) and NSFOCUS to participate in the review process.

"Default-On" Is an Industry-Wide Practice

On September 19, Taiyuan Chengming Technology Co., Ltd. formally sent a letter to Beijing Zhipu Huazhang, requesting written explanations on data deletion, private key storage, and whether cross-border data transmission had occurred. The company reserved the right to claim compensation and pursue legal action. Chengming Technology stated that, based on independent technical verification, ZCode's upload behavior was automatically triggered and occurred in batches. The data involved far exceeded ordinary "code snippets" and included complete project source code, system architecture designs, full version control history, database access credentials, cloud service permission tokens, and employee personal information—clearly exceeding the scope of data collection outlined in ZCode's Privacy Policy.

Root Cause: Default-On Code Collection

Reviewing the controversy, the core issue lies in the "default-on code repository collection feature." Tian Feng, Dean of the Fast Thinking and Slow Thinking Research Institute and a special commentator, told The Paper that this is a common industry practice, not a product oversight unique to any single company.

He analyzed that such a design was likely not motivated by malicious data collection. Instead, product teams likely treated "indexing data" as a standard product feature during design, without subjecting it to the security review process required for data leaving the local environment.

During the rapid expansion phase of the AI赛道, manufacturers prioritize product iteration, placing feature deployment ahead of data security.

Similar Incidents Occur Both Domestically and Internationally

This is not an isolated case. Previously, security research firm Backslash exposed OpenAI's Codex CLI. Attackers embedded instructions in the project's AGENTS.md configuration file, causing the Agent to silently send the developer's local key information during non-interactive execution, while the terminal output appeared completely normal. The fact that configuration files and indexing processes are trusted by default, without receiving the same level of auditing as the code itself, represents a widespread gap in this tool category.

An AI industry practitioner told The Paper that compared to manually written code, AI-generated code presents unique security risks:

• Probabilistic model outputs: Models may unconsciously leak keys or interface credentials present in training data, resulting in covert data transfer.
• High-speed batch generation: Vulnerabilities can be scaled up rapidly, making it difficult for companies to rely solely on traditional manual code reviews.
• Autonomous execution capability: Once an Agent gains project permissions, it can modify files in bulk. If maliciously exploited, the potential damage to production systems far exceeds that of ordinary development tools.

According to Guo Tao, most manufacturers currently do not incorporate the principle of data minimization at the product立项 stage. Default data uploads are not an isolated case. Furthermore, the industry lacks unified implementation standards, and the boundary between local indexing and cloud uploads is vaguely defined, leaving manufacturers with significant discretionary power. This conflict will not be limited to a single company. As more enterprise developers adopt AI coding tools, similar data privacy disputes will continue to erupt unless the industry proactively standardizes default product strategies.

Frequent Security Incidents in AI Coding

It is worth noting that the AI coding field has frequently been exposed to security risks, both domestically and internationally. The core of AI coding is using artificial intelligence technologies and tools to assist or automate software development.

Previously, the Ministry of Industry and Information Technology's cybersecurity department...

GitHub announced that, starting April 24, inputs, outputs, code snippets, and related context from Copilot Free, Pro, and Pro+ users would be used by default for model training and improvement. Users can opt out in their settings.

Cursor also disclosed that its code repository indexing feature is enabled by default, scanning users' opened code directories and syncing the indexed information to its servers. Additionally, Cursor previously fixed a high-risk logic vulnerability where a malicious Agent could bypass existing protection rules by modifying text files to read sensitive files that should have been excluded.

Regulatory Challenges in the AI Era

According to an industry insider who spoke to The Paper, China's current Personal Information Protection Law and Data Security Law clearly require data collection to follow the principles of minimization and consent. Excessive data collection without user knowledge is prohibited, and commercial source code is protected as a trade secret.

However, the difficulty lies in the fact that AI desktop clients differ from traditional mobile apps. They lack the routine pre-launch detection mechanisms that mobile apps undergo. Once software is packaged and distributed, the underlying client behavior is hidden within binary code. Ordinary users find it difficult to discover silent upload logic on their own, and regulators also struggle to proactively detect such covert client backdoors. Most cases only come to light after an incident is exposed, leading to a post-event accountability model.

This means that in the AI era, data privacy and entry-point security issues for new types of products have become the latest challenges facing the industry.

Zhipu's New "No Data Retention" Feature

Late on September 20, Zhipu's MaaS (Model as a Service) platform announced the launch of a "No Data Retention" feature. Once activated, user input and output data will only be used to complete the current model call and will not be stored statically.

A research report from CSCI Investment Banking believes that for highly sensitive scenarios such as finance, government, and code, clients are genuinely concerned about whether original prompts, model outputs, and code will be retained long-term on the platform. This MaaS update, by providing a no-data-retention option, effectively upgrades the commitment from a policy promise to a product-level capability. This is expected to lower the data compliance barriers for large clients purchasing API and Agent products.

The Need for Routine Auditing and Security Disclosure

From the perspective of long-term, healthy industry development, Tian Feng believes that China's AI coding ecosystem should establish two basic consensus principles:

• Data collection should be off by default, requiring explicit user confirmation.
• Auditing and security disclosure should be routine.

This requires the joint participation of leading manufacturers, enterprise clients, and regulators. It cannot be achieved through the self-discipline of individual companies alone.

He suggested that industry consensus could draw from the path taken by previous computing paradigms: a gradual transition from default trust to default least privilege. From mainframes to the PC internet, and then to mobile internet, each computing paradigm initially operated with default openness, only tightening permissions after problems emerged. The permission pop-ups and sandbox isolation mechanisms in today's operating systems and browsers were only established after multiple rounds of security incidents. AI coding tools are currently in a similar early stage. Proactively applying this lesson could reduce the need to repeatedly pay the same learning costs.

Tian Feng recommended considering the inclusion of automatic data collection features involving enterprise-level sensitive data (such as source code and keys) within the extended scope of the existing data compliance regulatory framework. This would involve applying the "default off, explicit consent" principle—already established for personal information protection—to similar enterprise data scenarios, providing corresponding compliance guidelines. He also encouraged the establishment of industry-level incident response time norms and routine audit disclosure mechanisms. This would create a unified, predictable compliance path to demonstrate that rectification has been completed, reducing the repetitive costs for individual companies and minimizing the situation where users must rely solely on self-monitoring to detect problems.

Future Risks: AI Coding Agents as Attack Vectors

Guo Tao told The Paper that the most significant security event to watch for in the AI coding tool赛道 over the next one to two years is not simple code leakage, but the use of coding agents as a springboard to invade a company's internal production environment.

AI coding tools are deeply integrated with enterprise code repositories and internal development environments. Once permission controls fail, malicious instructions could drive the tool to batch-read repository keys and configuration files, automatically complete code modifications, and submit deployments—forming an automated attack chain.

The second major risk lies at the supply chain level. A large number of enterprises reuse AI-generated components. Implicit vulnerabilities embedded in models can rapidly spread through open-source code to thousands of enterprise systems, creating cross-enterprise, large-scale security incidents. Unlike ordinary large model conversation leaks, risks from coding agents directly impact production operations. If such an event occurs, the resulting industrial losses and scope of impact would be significantly greater than those from typical large model security incidents.

(Source: The Paper)