Threat
Z.ai says sorry for slurping up your code, open sources ZCode
Publication date not yet evaluated · Added · 2 reports theregister.com
Page published · Page updated
Coverage timeline
Why it matters
ZCode's silent exfiltration of complete developer codebases shows how AI coding assistants can quietly siphon proprietary source and history to third-party cloud storage without consent or opt-out, echoing the earlier Grok/xAI repo-upload incident.
Chinese AI company Z.ai apologized after its ZCode code-generation harness was found silently packaging and git-encrypting entire user workspaces, including full project histories, and uploading them to Alibaba Cloud with a decryption key held only by Z.ai's servers. Researcher Ferstar found the behavior stemmed from ZCode's Repository Index functionality, was not disclosed in the privacy policy, and could not be disabled; Z.ai has since disabled the feature and commissioned CAICT and NSFOCUS assessments.
Summary
Chinese AI company Z.ai (formerly Zhipu) apologized after developers discovered that its code-generation harness, ZCode, was silently packaging, git-encrypting, and uploading entire user workspaces — including complete project histories — to Alibaba Cloud. The decryption private key was held only by Z.ai's server, so affected users could neither access nor delete the uploaded files.[0]
The behavior was first highlighted by researcher Ferstar, who reported there was no setting to disable the uploads and no disclosure of the practice in ZCode's privacy policy. The root cause was ZCode's Repository Index functionality, which triggered file uploads after the Repo Wiki feature generated cloud pages.[0]
In response, Z.ai apologized, said the uploaded data was never used to train its models, removed the Repo Wiki feature, commissioned assessments from CAICT and NSFOCUS that it says confirmed the uploaded data was deleted, and open sourced ZCode on GitHub. Ferstar confirmed Repo Wiki was gone from the released code but criticized Z.ai for wiping commit records and the pre-patch upload source code.[0]
Disclosure timeline
| Date | Event |
|---|---|
| July 2026 | xAI's Grok was scrutinized after its build was caught sending entire repos to the cloud — the incident to which the ZCode case is compared.[0] |
| Monday (week of 22 Sept 2026) | Z.ai released a statement apologizing for the ZCode security issues, confirming uploaded data was not used for training, removing Repo Wiki, and open sourcing the project on GitHub.[0] |
| 22 Sept 2026 | The Register reported on the disclosure and Z.ai's response.[0] |
How it works
ZCode's Repository Index functionality triggered the uploading of user files after the Repo Wiki feature generated pages in the cloud. The tool packaged and git-encrypted entire user workspaces, including complete project histories, and shipped them to Alibaba Cloud without a user-facing option to disable the behavior and without disclosure in the privacy policy.[0]
Because the private key needed to decrypt the uploaded data resided only on the server under Z.ai's control, affected users had no ability to access or delete the files that ZCode had uploaded on their behalf.[0]
Affected versions and patch status
| Product | Affected | Patch status |
|---|---|---|
| Z.ai ZCode (code-generation harness) | Pre-patch versions whose Repository Index / Repo Wiki functionality uploaded encrypted user workspaces to Alibaba Cloud | Repo Wiki feature removed; Z.ai claims all previously uploaded data has been deleted (per CAICT and NSFOCUS assessments) and open sourced the project on GitHub. Ferstar confirmed Repo Wiki is absent from the released code.[0] |
Key takeaways
- AI coding tools can silently exfiltrate entire developer workspaces to cloud storage as an undocumented side effect of features like repository indexing, creating serious data-confidentiality risk when the vendor holds the only decryption key.[0]
- Vendor remediation claims — data deletion, feature removal, and open sourcing — should be independently verified; here the researcher noted commit records and pre-patch upload source code were wiped, limiting transparency.[0]
- This is the second high-profile case in 2026 (after xAI's Grok) of a code-assistant harness shipping whole repositories to the cloud, indicating a recurring class of privacy flaw in AI development tooling.[0]
Defensive actions
- Users of ZCode should be aware that their workspaces may have been uploaded pre-patch, note Z.ai's claim that this data has since been deleted, and review the now open-sourced ZCode code for any residual upload behavior.: The tool uploaded entire workspaces without consent and users could not delete the data themselves; the vendor's deletion and removal claims warrant independent verification, especially given Ferstar's criticism that pre-patch upload code and commit records were wiped.[0]