Chinese AI firm Z.AI uploaded 313MB of user data without consent, triggering backlash

Developers have accused Z.AI, the Chinese firm behind the GLM models, of silently uploading hundreds of megabytes of local workspace data without user consent. The company reportedly made 564 unauthorized attempts to exfiltrate 313MB of data from user workspaces, sparking significant backlash from the developer community.

Z.AI, based in Beijing, has acknowledged the issue and stated it has resolved the problem. The firm has also announced plans to open source its ZCode codebase, a move that may be aimed at rebuilding trust with developers and the broader AI community.

The number of unauthorized data transfers—564 in total—has drawn particular scrutiny, as it highlights a potential systemic flaw in the company’s data handling practices. The 313MB of data exfiltrated could include sensitive information, raising questions about how user data is stored, accessed, and protected within Z.AI’s systems.

The incident underscores the growing risks associated with data privacy and vendor lock-in in AI development. Companies relying on third-party AI tools may face increased costs, governance challenges, and potential legal exposure if data security measures are not robust. Market reactions suggest a shift toward greater transparency and accountability in AI data practices.

Z.AI’s response, including the open-sourcing of its ZCode codebase, may serve as a temporary measure to address immediate concerns. However, the long-term impact of this incident on the firm’s reputation and the trust of developers remains uncertain, with ongoing scrutiny likely to shape future developments.