Case 09Z.ai / ZCode uploads
Z.ai's ZCode coding agent uploaded developers' workspaces and Git history without explicit notice or a working opt-out
ZCode packaged users' workspaces, including full Git history, and sent them to Alibaba Cloud storage by default. Z.ai apologized, removed the feature and open-sourced the client.
- Affected system
- ZCode desktop coding agent (confirmed in 3.10.0 and 3.12.3) and Z.ai's Alibaba Cloud storage
- Case status
- Follow-up open
- Sources checked
- Evidence
- Incident sources / Oversight
Overview
ZCode is a desktop AI coding agent from the Chinese model developer Z.ai, also known as Zhipu AI. It packaged users' project folders, including their full Git history, and sent them to Alibaba Cloud storage. The feature was on by default, and the settings meant to control it did not stop the upload. A developer published the finding on the morning of September 18, 2026, Beijing time. Z.ai apologized that evening and says the feature has been removed, the data destroyed, and the client open-sourced. S001 S003 S004
Case status: Follow-up open. Impact: 3 / Serious, provisional. Z.ai acknowledged that a default-on feature caused some users' repository data to be uploaded, and apologized to affected users. That meets the rubric's sensitive-data-access threshold, because repository contents reached vendor-controlled storage without explicit notice or a working opt-out. Z.ai has not said how many users or how much data. Record first published September 21, 2026; sources checked October 31.
Reported impact
Z.ai acknowledged that a default-on feature caused some users' repository data to be uploaded, and apologized to affected users. S003 S010 The developer who found it, known as ferstar, documented a 345MB commercial workspace packed into a 313MB encrypted archive. It failed 564 upload attempts and, by his account, never left his network. A separate 538-file public test repository produced an encrypted archive of about 15KB that the server accepted. S001 A separate user report describes accepted upload records and a pending archive of nearly 1GB. S002
Taiyuan Chengming Technology, a Chinese software company, publicly sent Z.ai a demand letter on the evening of September 19, Beijing time, alleging that ZCode uploaded its "data assets and trade secrets" without authorization. S005 On September 21 it withdrew the letter and its claims, according to China National Radio (CNR) and Caixin. According to CNR, Chengming said in a clarification that the letter and its media interviews contained "evidentiary errors, imprecise statements and excessive wording." S012 S013 CNR reported that, as of September 23, Z.ai had provided no further explanation of how many users were affected or whether historical data had ever been decrypted or accessed. S012 Guancha reported that nearly 400 people described as developers were taking part in complaint groups; that is not a count of affected users. S014 The number of affected users and the total volume received remain undisclosed.
What happened
Ferstar noticed ZCode's local folder had grown past 700MB and took the client apart to see why. He found that while a user was logged in, ZCode captured a snapshot of the whole workspace before prompts and after tasks. The snapshots included the complete .git directory, Git LFS files, reflogs and global configuration. Git data made up 86.6 percent of the commercial snapshot he examined. ZCode encrypted each archive and uploaded it through a Z.ai credential service to Alibaba Cloud's OSS storage. S001
Another user filed a bug in Z.ai's official GitHub feedback repository the same day. The report covered macOS version 3.12.3 and Linux version 3.10.0, and said uploads continued with the snapshot-indexing setting turned off. S002 Z.ai said the uploads came from a "code repository indexing" feature used for checkpoints, rollback and a Repo Wiki. It said uploaded data was destroyed immediately after the wiki was generated. S003
An engineering note published in Z.ai's open-sourced ZCode repository on October 10 is dated September 3 and 4. It records that on one workspace, on an unspecified machine/build, the client packed, encrypted and tried to upload the full .git directory, in a 1.3GB encrypted archive, at every prompt and at the end of every turn. Pending archives on that machine dated from August 27. The note calls this a product and specification issue, because the snapshot specification requires complete Git metadata ("要求完整 Git 元信息"). It does not say whether any of those uploads succeeded. S016
How the boundary failed
User logs in → ZCode snapshots the whole workspace, including Git history → archive encrypted with a key only Z.ai holds → upload credential from Z.ai → Alibaba Cloud OSS. S001
The failed boundaries were notice and user control. A coding agent needs to read files locally to work. Copying whole repositories and their history to the vendor's cloud is a different act, and users were not told about it. Ferstar found that the capture component started "unconditionally" at launch. The "Optimize Experience" and "Repo Snapshot Indexing" switches only affected what happened after upload. S001 S002 ZCode's privacy policy did not describe automatic full-workspace snapshots, according to RuntimeWire's review. S009
The encryption protected the archive in transit, but users could not open their own uploads. Only Z.ai could decrypt them, so users cannot independently check Z.ai's claim that the data was destroyed. S001 S006
Consequences
Developers using ZCode may have had proprietary code and commit history sent to a vendor without explicit notice or a working opt-out. Only Z.ai can say how much reached its servers. One company alleged trade-secret exposure, then withdrew the claim two days later, citing errors in its evidence. S005 S012 Z.ai's shares fell nearly 6 percent in Monday trading on September 21 before closing 1.8 percent higher. They closed 6.6 percent lower on September 22 and 12.4 percent lower on September 23. S008 S012
The evidence does not show that any uploaded code was misused, used for training or shared. Z.ai denies training use and retention. No outsider has inspected the cloud bucket or independently verified what Z.ai retained, accessed, processed or deleted. Several users did document server-accepted uploads. S004
Vendor response
On September 18, Z.ai apologized to affected users. It blamed the default-on indexing feature and said uploaded data "会立即销毁，不会保存" ("will be destroyed immediately and will not be saved"). It gave all ZCode users an extra weekly quota reset and promised to open-source the client and invite third-party review. S003 S006
On September 21, Z.ai said remediation was complete, that it had "无留存，也从未将其用于模型训练" ("no retention, and never used it for model training"), and that version 3.14.0 removed the upload path. It said the China Academy of Information and Communications Technology found zero data in the cloud bucket and that NSFOCUS confirmed the bucket and its objects were deleted. It also announced a vulnerability reporting program with rewards. S004 S008 Ferstar's review of the released code found the upload pipeline removed, though the published repository history was flattened to two commits. On September 23 he rechecked version 3.14.3 and its packaged desktop app and again found no upload pipeline. He noted that matching version tags do not prove the shipped binaries match the public source. S001 The audit reports themselves were not available for this record.
On September 28, ZCode announced a second round of user compensation. It repeated that the snapshot upload path had been removed and the cloud data deleted, and it said no content would be uploaded unless the user starts the action. Huxiu, republishing Baobian, reported that Z.ai had also promised monthly security audit reports. S018 Z.ai's September 21 statement said the full CAICT and NSFOCUS reports would be published soon, according to Ferstar; CNR could not find them as of September 23. S001 S012 As of October 31, searches of ZCode's public site and changelog, Z.ai's ZCode GitHub repository, CAICT, NSFOCUS and the wider web had not found the CAICT or NSFOCUS reports or a monthly audit report. The public repository now receives periodic source syncs, but issues remain disabled and code before version 3.14 is still unpublished. Z.ai's own documentation says encrypted snapshot packages from the retired feature may remain on upgraded users' machines. S015 S017
Official oversight
Checked October 31, 2026: China's Cyberspace Administration and Ministry of Industry and Information Technology.
| Authority | Action on this incident | Status / basis | Next step | Official source |
|---|---|---|---|---|
| Cyberspace Administration of China; MIIT | No public action found in searched sources | Scoped absence finding | Watch for a regulator inquiry or complaint outcome | None found |
No incident-specific regulator action was found as of October 31. That does not establish that none exists. Taiyuan Chengming Technology's letter, which reserved the right to complain to regulators and to sue, was withdrawn on September 21. It was a private legal demand, not official oversight. S005 S012
What remains open
Established in this record
ZCode desktop versions at least as early as 3.10.0 captured whole workspaces, including Git history, and sent them encrypted to Z.ai-controlled cloud storage. This happened by default, and the settings did not stop it. Z.ai acknowledged that a default-on feature caused some users' repository data to be uploaded, apologized, removed the feature and cites audits saying the storage was deleted.
Still unknown
- How many users were affected, how much data Z.ai received, and since when. A Z.ai repository note records pending snapshot artifacts on one unspecified machine/build dating from August 27; Z.ai has not given a figure. S012 S016
- What the CAICT and NSFOCUS audits actually examined, beyond Z.ai's summary.
- Whether Z.ai will publish the CAICT and NSFOCUS reports and the monthly audit reports it promised.
Next reporting step
Obtain the CAICT and NSFOCUS reports, the promised monthly audit reports and Z.ai's original Feishu statements. Seek Z.ai's figures on affected users and the release history of the snapshot feature. Check for any regulator action.
Record updates
-
October 31, 2026: Correction and follow-up. Taiyuan Chengming Technology withdrew its demand letter and claims on September 21, citing errors in its evidence. The record had still listed the letter's October 10 deadline as open, and that has been corrected. Added CNR's report that Z.ai had not provided an affected-user figure (published September 23), an engineering note published in Z.ai's repository on October 10 documenting full-.git capture by specification on one unspecified machine/build and pending artifacts dating from August 27, Z.ai's September 28 compensation and remediation statement, and the October 31 search finding that the CAICT and NSFOCUS reports were not found on ZCode's public site, Z.ai's ZCode GitHub repository, the auditors' sites or the wider web. Severity is unchanged. It rests on Z.ai's acknowledgement of uploads, not on the withdrawn claim. The repository note strengthens the mechanism and design account but does not independently increase demonstrated impact.
-
September 21, 2026: Initial research draft. Covers the ZCode uploads disclosed September 18 and Z.ai's response through September 21. The affected-user count and the audit reports are not available.
-
September 21, 2026: Initial source-checked record published as IB–2026–009. The account and its evidence limits are unchanged from the fact-checked research draft.