Loading story…
Z.ai apologized after researchers found its ZCode AI coding assistant compressing, encrypting, and uploading developers’ local workspaces—including project histories—to Alibaba Cloud without consent. The behavior was enabled by default in the Repository Index and Repo Wiki features, lacked a user opt-out or clear privacy-policy disclosure, and reportedly made hundreds of upload attempts against a 313 MB archive; one researcher observed a 15 KB file successfully transferred.
The company said the uploaded data was not used to train models, removed the Repo Wiki capability, and stated that external assessments by CAICT and NSFOCUS verified deletion of previously uploaded data. Z.ai also open-sourced ZCode for outside review, but researchers noted that the release omitted prior commit history and the vulnerable pre-patch upload code; the server-controlled encryption key had also prevented affected users from independently accessing or deleting their uploaded data.
Track how attackers are adapting to this technology.
4 events from the most recent confirmed update back to the earliest known activity.
Z.ai publicly apologized and said it had fixed ZCode's unauthorized local file and data uploading behavior. It said uploaded cloud data had been destroyed and was not used to train AI models.
Z.ai open-sourced the ZCode project on GitHub and said it would invite third-party review and establish a vulnerability reporting and response process. Ferstar said the release no longer included Repo Wiki, but criticized it for omitting prior commit history and the pre-patch upload code.
As part of remediation, ZCode removed the Repo Wiki feature associated with the uploads. Z.ai commissioned CAICT and NSFOCUS to assess the changed product and said their assessments concluded that previously uploaded data had been deleted.
Researcher Ferstar reported that ZCode's Repository Index and Repo Wiki functions packaged, git-encrypted, and attempted to upload entire local workspaces and project histories to Alibaba Cloud. The behavior reportedly had no user opt-out and was not disclosed in the privacy policy; a second blogger reported a similar experience.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
theregister.com
Open sourcetomshardware.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
xAI's Grok Build coding CLI was found uploading users' entire tracked Git repositories to an xAI-controlled Google Cloud Storage bucket, including full commit histories, unread files, and sensitive data such as tracked `.env` contents and previously deleted secrets. Researcher **cereblab** said the behavior occurred even when the tool was asked not to open files and only return a simple response, and demonstrated the scope by intercepting an upload bundle that contained a planted canary file and complete repository history rather than only files needed for the coding task. Following public disclosure, xAI reportedly disabled the behavior server-side by setting flags including `disable_codebase_upload: true` and `trace_upload_enabled: false`, while Elon Musk said previously uploaded user data would be deleted. xAI said enterprise zero-data-retention users were not affected and that consumers could use `/privacy` to disable retention and delete synced data, but the researcher argued the real fix was the silent global flag change and noted upload code remained present in later client builds behind server-side controls, leaving unanswered questions about default data collection, retention, and the number of affected users.
Jul 20, 2026
Alibaba has ordered employees to stop using Anthropic’s **Claude Code** for work and reportedly directed them to remove other Anthropic products, classifying the software as high risk over alleged security vulnerabilities and backdoor concerns. Internal guidance said the ban would take effect on July 10, with staff told to switch to Alibaba’s internal **Qoder** platform instead. The move followed claims that Claude Code contained concealed environment-detection logic that checked proxy settings and system time zones against lists associated with Chinese companies including Alibaba, Baidu, ByteDance, Ant Group, and Moonshot AI. The allegations originated from a June 30 Reddit reverse-engineering post that said the logic had been present since Claude Code version `2.1.91` and encoded detection results through subtle changes to internal system prompts rather than explicit telemetry, making monitoring difficult. Anthropic had not publicly confirmed the issue in full, but an engineer reportedly said the mechanism was an experiment aimed at preventing reseller abuse, unauthorized access, and model distillation, and that the code was removed on July 1. The dispute comes amid broader tensions between the companies after Anthropic accused operators linked to Alibaba’s Qwen lab of using fraudulent accounts in a large-scale model distillation effort.
Jul 11, 2026
A critical vulnerability was discovered in GitHub Copilot Chat that could have allowed attackers to exfiltrate private source code and sensitive secrets from repositories by exploiting the platform’s AI assistant and image proxying service. The flaw, identified by Legit Security researcher Omer Mayraz, involved a sophisticated attack chain that combined remote prompt injection with a bypass of GitHub’s content security policy. Attackers could embed hidden prompts within pull request comments or other repository content, which Copilot Chat would process without proper isolation or validation. This allowed the attacker to manipulate Copilot’s responses and assemble signed image links that leveraged GitHub’s Camo image proxy service to transmit stolen data outside the platform. The exploit, dubbed "CamoLeak," demonstrated that even advanced AI-powered developer tools can be manipulated to leak confidential information, including passwords and private keys, with minimal user awareness. The proof-of-concept attack showed that the exfiltration channel was subtle enough to evade detection by both users and GitHub’s monitoring systems. GitHub Copilot Chat’s context awareness, which enables it to read repository files, pull requests, and other workspace artifacts, was a key factor in the attack’s success, as it provided the AI assistant with access to sensitive data that could be extracted through manipulated prompts. Upon responsible disclosure via HackerOne, GitHub responded by disabling image rendering in Copilot Chat and patching the vulnerability as of August 14. The incident highlights the growing risks associated with integrating AI agents into software development workflows, especially when such agents have broad access to sensitive project data. Security experts noted that while the attack was limited in the amount of data it could exfiltrate at once, the potential impact was significant due to the nature of the information at risk. The case underscores the importance of rigorous security validation for AI-driven features and the need for continuous monitoring of new attack vectors as AI adoption accelerates in development environments. GitHub’s swift response and remediation efforts were commended, but the event serves as a cautionary tale for organizations relying on AI-powered coding assistants. The vulnerability also illustrates the creative lengths attackers may go to bypass security controls, turning legitimate platform features like image proxies into covert data exfiltration channels. The research community continues to scrutinize AI integrations for similar weaknesses, emphasizing the need for secure-by-design principles in next-generation developer tools. Organizations are advised to review their use of AI assistants, ensure prompt application of security updates, and educate developers about the risks of prompt injection and related attacks. The incident has prompted broader discussions about the balance between AI functionality and security, especially as more platforms embed intelligent agents into core workflows. Ultimately, the GitHub Copilot Chat vulnerability demonstrates both the promise and peril of AI in software development, reinforcing the need for vigilance and proactive defense measures.
Jun 29, 2026