ZCode, an AI coding assistant built by Chinese firm Z.ai, silently uploaded encrypted archives of local developer Git repositories to Alibaba cloud storage using encryption that only the company could unlock. Discovered by developer Ferstar, the feature left users unable to verify upload contents or confirm deletion claims.
Inside the 313MB Repository Snapshot Failure
When a developer writing under the alias Ferstar poked around the local directory of Z.ai’s ZCode client, he uncovered more than just configuration files. Waiting in the queue for transmission to Alibaba’s cloud infrastructure was a 313MB encrypted archive. According to reporting by Minxiao Chang and Wency Chen for the South China Morning Post, the system had already attempted to upload this payload 564 times, failing repeatedly before a smaller file successfully slipped through.
The core architectural failure lay in how the data was locked down. The archive was encrypted using a private key held exclusively on Z.ai’s backend. Neither the local developer nor the ZCode client itself possessed the decryption keys necessary to inspect the snapshot once it landed in the cloud. That lock meant that when Z.ai later issued assurances that the data had been wiped, external verification became impossible. Only Z.ai could say it was deleted, because only Z.ai could ever see what was inside.
The Default Setting That Exposed Credentials and Hostnames
The silent data exfiltration was not hidden away in an obscure menu. It was tied directly to a repository-indexing feature designed to power session checkpoints, version rollbacks, and an automated Repo Wiki. This feature was toggled on by default immediately following the tool’s launch.
Generating a Wiki page in the cloud did not simply scrape current source code files. Instead, it triggered a full repository upload. That sweeping action scooped up Git history, dragging old credentials and internal hostnames into remote cloud storage without explicit user consent.
The Industry Fallout and Divergent Vendor Responses
The backlash was swift. A robotics company reportedly banned Z.ai’s tools from its internal networks following the disclosure. Developers across technical forums noted that while Z.ai’s open-weight models could still be run safely through alternative clients, the trust deficit created by the ZCode incident would likely outlast the software patch.
The handling of the incident stands in sharp contrast to similar security mishaps across the AI ecosystem. Earlier, when xAI faced a comparable backlash over unexpected Git repository uploads in its Grok Build tool, Elon Musk confirmed the behavior, and xAI deleted prior user data, formalized a zero-retention policy, and introduced a dedicated privacy endpoint. Crucially, an outside retest confirmed that uploads had stopped.
Z.ai’s remediation path has been far less transparent. The company issued a public apology stating the issue had been resolved, but it has failed to publish a detailed data retention policy or permit independent verification checks.
