Z.ai encrypted the workspace it uploaded so that only Z.ai could open it. Now only Z.ai can say it was deleted.
The discovery was not merely an anomaly of a single failed upload; Ferstar noted that the ZCode client had attempted the transfer 564 times, failing each attempt, while a smaller, separate file had successfully been transmitted. This revelation has prompted a broader investigation into the inner workings of ZCode, with other developers, including blogger Feng Ruohang, reporting similar unauthorized data transmissions.
A Breach of Trust: The Mechanics of the Incident
The core of the issue lies in the nature of the data being harvested. Coding agents like ZCode are designed to index repositories to provide context-aware suggestions and automated features. However, the files being uploaded were not simple working documents; they were comprehensive snapshots of commercial projects, including full Git histories.
In software development, the Git directory is the "black box" of a project’s lifecycle. It contains every iteration, change, and commit made since the repository’s inception. This includes sensitive information such as revoked credentials, internal hostnames, abandoned experimental branches, and private commit messages that were never intended for external consumption. By capturing the Git history, ZCode was effectively exfiltrating the entire intellectual property of the affected projects.
Compounding the severity of the incident is the fact that the encrypted archives were inaccessible to the users themselves. Ferstar reported that because the private key required to decrypt the files was stored exclusively on Z.ai’s backend, the users were left in the dark regarding exactly what data had been sent to the cloud. This created an asymmetric security model: the company possessed the ability to view the developer’s most sensitive work, while the developer—the owner of that work—could not verify the contents of the transmission.
Chronology of the Disclosure and Response
The timeline of the incident reflects a rapid escalation from individual suspicion to widespread public scrutiny.
- Friday Morning: Ferstar publishes findings on social media, detailing the 313MB encrypted archive and the 564 failed upload attempts.
- Friday Afternoon: Additional developers, including Feng Ruohang, corroborate the findings, reporting multiple instances of unauthorized file uploads.
- Friday Evening: Z.ai issues an official statement via its Feishu community, acknowledging the incident and claiming it has been resolved.
- Saturday: Developers express skepticism, pointing out that Z.ai’s claim of "immediate destruction" of data is unverifiable due to the closed-source nature of the client and the encryption used.
- Sunday: The South China Morning Post publishes an investigation into the matter. Alibaba, the provider of the cloud storage used for the uploads, remains silent regarding the incident.
In its official response, Z.ai framed the unauthorized uploads as a feature rather than a security flaw. The company explained that the behavior was tied to a "code repository indexing" function designed to support session checkpoint recovery, version rollbacks, and a Repo Wiki. According to Z.ai, the generation of a Wiki page in the cloud acted as a trigger for the repository upload, and this feature was enabled by default upon the software’s launch.
This explanation has met with significant pushback from the cybersecurity community. Critics argue that a "feature" that silently transmits a user’s entire Git history to a third-party server without explicit, granular consent is fundamentally indistinguishable from malicious behavior.
Security Implications for AI-Driven Development
This incident underscores a growing divide in the industry between the trust placed in AI coding tools and the actual security auditing these tools undergo. While chatbots like ChatGPT or Claude operate primarily through text-based inputs, modern "coding agents" require deep integration into a developer’s local environment. This elevated privilege level necessitates a higher standard of security and transparency, which appears to be currently lacking.
The ZCode situation is not an isolated event. Earlier this year, a similar incident occurred involving xAI’s Grok Build, which was found to be uploading entire Git repositories to its servers despite marketing claims that no codebase data would be transmitted. In that instance, the privacy toggle intended to prevent such uploads was found to be non-functional. The subsequent resolution—where Elon Musk confirmed the issue, deleted user data, and implemented a transparent privacy endpoint—set an industry benchmark that Z.ai has yet to meet.
The Regulatory and Policy Gap
A review of ZCode’s privacy policy, effective as of June 15, reveals a stark misalignment between the company’s stated practices and the reality of the software’s behavior. The policy mentions that the service collects "text, files and code submitted through conversation," but it makes no mention of automated repository snapshotting or the transmission of Git history.
Furthermore, the document’s permissions table details access to network and storage, yet it fails to account for the systematic bundling of local directories. The only data control mentioned—the "Optimization Program"—is designed to manage data for training purposes and is set to "off" by default. Consequently, developers who meticulously reviewed the policy and opted out of the training program had no reason to believe their repositories were at risk. This "policy gap" has become a significant liability for Z.ai, as it suggests that the company’s internal development practices were either disconnected from their legal documentation or intentionally obfuscated.
Market Impact and Future Outlook
The commercial fallout has already begun. Several major companies in the Chinese tech sector have reportedly begun issuing internal bans on Z.ai’s tools, citing security concerns as the primary driver. This represents a significant blow to Z.ai, a company that has built its market position on the premise of "open weights"—making its high-performing AI models accessible to the public for free while monetizing the surrounding ecosystem of tools and services.
Founder Tang Jie has long championed the idea that safety and security in AI are achieved through broad participation and community oversight. However, this incident suggests a failure to apply those principles to the client-side software installed on developers’ machines. By keeping the ZCode client proprietary and opaque, Z.ai has undermined the very ethos of open collaboration it seeks to promote.
For Z.ai to recover its reputation, industry experts suggest several critical steps:
- Independent Verification: The company must allow for third-party, independent security audits of the ZCode client to confirm that all unauthorized upload paths have been permanently closed.
- Transparency of Codebase: While Z.ai has promised to open-source the ZCode client, the burden of proof rests on whether the specific components responsible for repository packaging are included in that release.
- Verifiable Data Destruction: To address the "destruction claim," Z.ai needs to provide cryptographic or process-based evidence that the uploaded data was indeed purged, rather than simply stating it as a matter of fact.
- Policy Alignment: The company must update its privacy policy to clearly define what data is accessed, how it is stored, and what mechanisms are in place for users to audit their own data.
As the industry moves toward deeper integration of AI in software development, the "ZCode Incident" will likely be studied as a cautionary tale. It highlights that in the race to deploy AI features, the fundamental security of the developer’s workspace cannot be treated as a secondary concern. For developers, the message is clear: the convenience of AI-assisted coding must be weighed against the potential cost to the security of their intellectual property. Until Z.ai can provide objective proof that its tools are secure, the breach of trust may prove difficult to repair, regardless of the quality of their underlying models.
