Skip to content
TrustList
News

Z.ai apologises after its ZCode agent was found uploading repository snapshots

Editorial

By TrustList Editorial

On 18 September a researcher showed Z.ai's ZCode app packing whole workspaces, Git history included, for cloud upload. Z.ai apologised, shipped 3.14.0 and published its code. Treat repos opened in older versions as shared.

About Z.ai apologises after its ZCode agent was found uploading repository snapshots

Z.ai apologises after its ZCode agent was found uploading repository snapshots

22 September 2026 — On 18 September 2026 a developer who blogs as ferstar, and describes themselves as a paying subscriber, published an analysis of ZCode, the AI coding desktop app from Z.ai (Zhipu). The analysis says version 3.12.3 packed whole workspaces, including the full .git history, Git LFS caches and reflogs, encrypted them and posted them straight to Alibaba Cloud object storage using upload credentials issued by Z.ai's servers. Z.ai apologised the same day. On 21 September it said the problem was fixed and published ZCode's source code.

Not yet independently verified. Z.ai's apology and 21 September statement were not read on Z.ai's own site: they were posted in user groups and on X, and are taken here from IT Home and Sina Tech. Deletion of the uploaded data, the audit findings and "never used for training" are Z.ai's claims as reported; the audit reports are not published. We will update this when it can be confirmed, and remove this note.

What was found and what Z.ai says

According to the researcher, the upload ran whenever a user was logged in, and turning off the app's "Optimize Experience" and snapshot-indexing settings did not stop it. The encryption keys were controlled by the server, so users could not decrypt the archives sitting on their own disks. A 313MB snapshot of a commercial project failed to upload because of size limits, the researcher says, but a snapshot of a small public repository was accepted by the server.

Z.ai's first response, posted in its user groups on 18 September and reproduced by Sina Tech, said the uploads came from a code-indexing feature that supported session checkpoints and a "Repo Wiki" knowledge base. It said the feature was on by default at launch, that uploaded data was destroyed once each wiki page was generated, and it gave all users an extra weekly quota reset.

On 21 September, as reported by IT Home, Z.ai said ZCode 3.14.0 removes Repo Wiki and cuts the snapshot upload path. It said it keeps no code data and has never used it for model training. It cited audits by the China Academy of Information and Communications Technology and NSFOCUS, which it says found the storage bucket empty and then deleted. Z.ai's own changelog dates 3.14.0 to 19 September and lists a fix for "abnormal uploads" in the repository wiki; version 3.14.1 followed on 22 September.

The code is on GitHub under the Apache-2.0 licence. The repository was created on 20 September, has issues switched off and holds just two commits, so it does not show how the upload code was removed. The researcher reviewed it and says the upload endpoint and the Repo Wiki code are gone.

What to do

  • Upgrade every ZCode install to 3.14.0 or later, or remove it. Check developer laptops, not only managed builds.
  • Treat any repository opened in ZCode before the fix as shared with a third party, including its whole history, not just the current files.
  • Rotate any secret that was ever committed to those repositories, even if it was later deleted, because the history went with the snapshot.
  • Read Z.ai's data terms before approving the tool again. Its English privacy policy, effective 15 June 2026, says content is used for training only if you opt in, but does not mention workspace snapshots.
  • Ask Z.ai in writing whether your workspaces were uploaded, and ask for the full audit reports once published.

What the announcement leaves out

Z.ai has not said how many users or repositories were uploaded, how long snapshots were held or who could decrypt them. The statements that data was deleted and never used for training are Z.ai's own, and the audits have been summarised rather than published. The researcher notes that emptying a bucket after the event cannot show what happened to data uploaded before it.

Sources

Keep exploring

More on TrustList

Everything here links back to the same verified catalogue. Pick your next stop.