Coding-workspace upload incident
Unnamed: a Chinese AI company · coding agent
- What happened
- Developers found that a default-on indexing feature in an AI company's coding tool packaged local workspace files, including repository history, for cloud upload without a clear consent step. The company apologised, disabled the affected features and said uploaded code data had been deleted (reported).
- Impact
- One developer reported a completed 15 KB upload and a larger archive waiting to upload (reported). The number of affected users and any access to the uploaded material have not been made public.
- What would have caught it
- Show the exact files and destination, and require a person’s approval, before any repository-wide upload. Log outbound transfers so they can be audited.
- Sources
- News report (South China Morning Post) (source date 2026-09-20)
- Reuters report (via MarketScreener) (source date 2026-09-21)