Z.ai faces backlash over unauthorised data uploads

Reports that Z.ai’s tooling may have uploaded user data without consent have triggered a reputational problem for the Chinese AI firm. The key issue is not simply whether data moved from one system to another. It’s whether users knew it was happening, understood what was being sent, and had a meaningful chance to say no. According to the original report, users spotted what they believed were unauthorised uploads.

For business owners, this is a reminder that AI tools need the same scrutiny as any employee or external supplier handling company information. An agent that can read files, connect to systems, or send data externally can be useful. It can also create a problem quickly if its permissions, logging, and approval rules aren’t clear. “Silent” behaviour is especially risky because the business may not know what happened until a customer, employee, or regulator asks questions.

The practical response is simple. Audit what each AI tool can access, where it can send information, and whether activity is recorded in a way a non-technical manager can review. Ask vendors direct questions about default data settings and consent. Test the tool with non-sensitive information before connecting it to live systems. This is the kind of thing we build into an AI command centre, with visibility over agents, permissions, and actions rather than blind trust.