Your AI Coding Assistant May Understand Your Entire Codebase. But Where Is That Code Going?

Developers give AI coding assistants unusually broad access. A useful agent may read source files, understand dependencies, inspect configuration and use repository history to answer questions. That access can make the tool effective, but it also changes the security questions teams need to ask.

Recent reporting on Z.ai, also known as Zhipu AI, shows why. Developers investigating its ZCode desktop assistant reported that local workspace snapshots, including Git history, were being encrypted and sent to Alibaba Cloud object storage without explicit consent. One researcher documented a large archive from a commercial project and repeated upload attempts.

Z.ai apologised, disabled the affected functionality and attributed the behaviour to its Codebase Indexing feature, which had been enabled by default. The company said it had completed remediation and deleted uploaded data. That deletion claim comes from the company and has not been independently verified.

Indexing is not a small permission

A repository can contain much more than the files visible in the current working directory. Git history may preserve old configuration, internal hostnames, abandoned branches and material that a developer believed had already been removed. A coding agent that indexes the whole workspace may therefore handle a wider set of information than its interface makes obvious.

The important question is not simply whether a model is capable. Teams need to know:

• Which files and repository history the assistant can access
• Whether indexing happens locally or in a cloud service
• What data is transmitted, retained or used for training
• Which organisation controls encryption keys
• Whether administrators can disable uploads and restrict agent permissions

A wider enterprise architecture question

The incident also connects directly to the growing interest in AI systems that keep source code inside company-controlled infrastructure. Local deployment does not automatically make a system secure, but it can change who receives sensitive code and where inference happens.

Aiexl. takeaway

Convenience without understanding permissions can become a security problem. Developers increasingly need to understand where coding assistants process code, what data leaves their environment and what permissions agents receive. AI engineering now includes making informed choices about data boundaries, access and deployment architecture.