ZCode Uploaded Developers' Entire Git Histories Without Asking. Z.ai's Fix Doesn't Say Who Already Read Them

On September 18, a reverse-engineering report set off a week of scrutiny for Z.ai, the Chinese lab formerly known as Zhipu AI and the company behind the open-weight GLM models. The subject was not a model. It was ZCode, Z.ai's AI coding agent, and the finding was that the tool had been packaging developers' working directories — source code, configuration, and complete Git histories — into encrypted archives and uploading them to cloud storage before anyone chose to share anything.

What the tool did

ZCode runs inside a developer's editor, where it has the filesystem access any coding assistant needs. According to the researchers who took the client apart, a background "codebase indexing" routine kicked in on sign-in, on opening a project, or when a user enabled the agent's smarter features — none of which is a deliberate "upload my code" decision. The routine collected the workspace and, crucially, the entire .git directory: commit history, Git objects, and Git LFS caches. It compressed and encrypted the result with AES-256-CTR, requested an RSA public key and Alibaba Cloud object-storage credentials from Z.ai's servers, and pushed the archive up.

The figures from a single installation the researchers analyzed give the shape of it.

Two details matter more than the size. First, there was no consent step: signing in was enough. Second, Z.ai held the decryption key, which means a developer could neither read nor control the copy of their own repository sitting in the vendor's bucket. For a private codebase, a full Git history is often worse to lose than the current working tree — it can hold deleted secrets, internal branch names, and the entire record of how the software was built.

Z.ai's response

To the company's credit, the reaction was fast and unusually open. Z.ai acknowledged the problem and apologized the same day the report appeared. On September 20 it published ZCode's client source on GitHub, where the repository drew several thousand stars within a day, framing the release as putting the code under community scrutiny. On September 21 it laid out a remediation: the offending feature was removed in a new client version, and two Chinese security bodies — the state-linked CAICT and the vendor NSFOCUS — were commissioned to check the work. CAICT reported that the storage bucket had reached a "zero-data state" and that the feature was gone; NSFOCUS said it could find no path in the fixed client that would regenerate a local snapshot for upload. Z.ai says the data objects and the bucket itself have been deleted.

Open-sourcing a tool after it embarrasses you is more than most vendors do, and deleting the bucket is the right move. But the audits describe the world after the fix. They do not, and cannot, say who read the archives while they existed, how long they were retained, or what became of the histories already collected. The full assessment reports had not been published as of the company's statement, and both auditors were engaged by Z.ai. The apology never directly explained why a coding assistant needed the whole Git history in the first place.

The part that isn't about Z.ai

It is tempting to file this under "Chinese app does something alarming with your data," but that framing misses the more useful lesson. An AI coding agent is, by construction, a program with read access to your source tree and a live connection to its maker. Indexing a codebase for context is the entire value proposition; shipping that index somewhere is one configuration flag away from being a feature. ZCode is the documented case, but nothing about the mechanism is specific to one lab or one country. The industry has no shared norm for disclosing what these agents send home, and no independent body that audits them before an incident rather than after.

For anyone running an AI coding agent today, the practical response is the same regardless of vendor. Update ZCode if you use it; the fixed client removes the feature. More broadly, treat these agents as data-egress surfaces: check what indexing and telemetry they enable by default, prefer to point them at code you would not mind leaving your machine, and watch their network behavior on sensitive repositories. The convenience is real. So is the fact that the thing reading your code can also send it.

Sources: Tom's Hardware, ZCode source on GitHub (zai-org/ZCode), StableLearn: ZCode Git-history upload incident, RuntimeWire: Z.ai open-sources ZCode after Git-history upload, DEV: ZCode answered its critics — open source, third-party audits, a deleted bucket