Shares of Z.AI (2513.HK) plunged 13% to HK$691 on September 23 after reports surfaced that the company's ZCode coding assistant had been quietly uploading users' local code repositories and Git histories to external cloud servers without clear consent. The selloff wiped out nearly two weeks of gains — the stock had climbed steadily from HK$680 to HK$794 over the prior five sessions — and raises pointed questions about whether a company built on developer trust can survive a breach of exactly that. Z.AI's Coding Tool Secretly Uploaded Users' Code — Can a $62 Billion AI Company Survive a Trust Meltdown?
Shares of Z.AI (2513.HK) cratered 13% to HK$691 on September 23, erasing two weeks of gains after developers discovered the company's coding assistant had been secretly packaging and uploading their entire code libraries to cloud servers. For a company that pitched itself as the trustworthy alternative in AI development tools, the timing could not be worse.
A Developer Caught What Z.AI Didn't Disclose
An independent technical blogger inspected ZCode's local files and found a compressed 313-megabyte file queued for upload to Alibaba's cloud storage after failing 564 times, while a smaller file had already been sent.
The tool was silently packaging users' entire workspaces — including complete version histories and deleted file records — encrypting them, and sending them to external storage.
The private decryption key was held only by Z.AI's servers, meaning users could neither access nor delete what had been uploaded, and there was no option to disable the behavior or disclosure in the privacy policy. For enterprise clients evaluating AI coding tools, this is disqualifying.
The Apology Came Fast, But the Open-Source Fix Has a Hole
Z.AI apologized, open-sourced ZCode, and commissioned two security assessments; the developer who found the problem confirmed the upload code has been removed. But the published source code repository carries only two commits, with the entire development history erased — undermining the transparency the gesture was supposed to deliver. Investors should note: open-sourcing a product also means giving away its competitive value for free, a costly tradeoff when the company just raised over US$6 billion via a share placement and zero-coupon convertible bonds on September 18 — the same day the scandal broke.
This Isn't Z.AI's First Crisis of Confidence
In late February, Z.AI's shares fell 23% after compute shortages forced it to restrict new user signups.
With a market capitalization of roughly US$62 billion as of August , the stock trades at a steep premium to revenue, meaning trust is the valuation. Each self-inflicted crisis chips away at the premium investors pay for growth expectations.
Analyst Consensus Hasn't Caught Up Yet
According to 23 analysts, the average rating remains "Buy" with a 12-month price target of HK$1,652 — more than double today's price. That gap will narrow fast if enterprise clients pause procurement or China's regulators, who are tightening data-security rules, intervene. The stock's 52-week range of HK$116 to HK$2,980 tells the full story: this is a name driven by sentiment, and sentiment just took a direct hit.