Z.ai has released the code for its ZCode programming assistant after acknowledging a flaw that sent developers’ local project files to Alibaba Cloud servers without permission. The company said it has stopped the uploads, deleted any data that had reached its cloud, and did not use that material to train its models.
The issue surfaced on September 18, when an independent Chinese tech blogger known as Ferstar examined ZCode’s working directory and found files being prepared for upload. The disclosure has raised broader questions about how much data left users’ machines, what exactly was retained, and whether outside developers can independently verify Z.ai’s account of what happened.
How the issue was discovered
According to the source report, Ferstar found that ZCode was assembling archives for transfer to Alibaba’s cloud storage. He later told the South China Morning Post that the larger package was an encrypted 313 MB snapshot of a commercial project he was developing, and that it included the project’s Git history.
Ferstar said neither he nor the ZCode client could open the archive because it had been encrypted with a private key held by Z.ai on the back end. That detail has become central to the aftermath of the incident, because it limits outsiders’ ability to confirm what was contained in the uploaded material or what happened to it afterward.
Feature design and possible exposure
Z.ai linked the unauthorized transfers to a repository-indexing feature used for session checkpoints, version rollback and a tool described as a Repo Wiki. The feature was enabled by default after ZCode launched.
The report says full repository uploads could be triggered when a new wiki page was created in the cloud, meaning exposure may not have been limited to the files a developer was actively editing. Because a repository snapshot can also contain Git history, the potential sensitivity extends beyond source files themselves and may include old credentials or hostnames that help identify internal systems.
Z.ai’s response and remaining uncertainty
The company apologized and said the unauthorized uploads had been halted. Z.ai also said data sent to its cloud had been destroyed and had never been used for model training.
At the same time, important questions remain unresolved for outsiders. The source article notes that Z.ai has not announced documented changes to its retention policy or provided a way for independent retesting. Since the company controls the only decryption key mentioned in the report, external verification of its deletion claim is difficult. Z.ai said it plans to create a standing process for reporting product security flaws, with rewards tied to severity, and has asked developers to continue reviewing the newly open-sourced codebase.
Trust fallout and market reaction
The incident has already had consequences beyond the technical fix. A robotics company has reportedly barred Z.ai’s tools internally, and developers cited by the South China Morning Post said the trust damage could be more serious than the bug itself.
The report also compared the episode with a July incident involving xAI’s Grok Build, which was found uploading entire Git repositories before xAI deleted the data, announced a zero-retention policy and introduced a privacy endpoint. An independent retest later found the uploads had stopped. No equivalent outside retest for ZCode has been reported so far.
In the market, shares of Z.ai, traded in Hong Kong under 2513.HK, fell almost 6% during Monday’s session before reversing course to finish 1.8% higher. The next clear milestone will be whether outside developers auditing the open code can confirm how the upload path worked and whether the issue is fully closed.
Source: Cryptopolitan