In response to the ZCode product security issues reported by the community, we have completed the necessary remediation and sincerely apologize to all our users.
Z.ai posted that on Monday, on ZCode’s official account. The Beijing company, formerly Zhipu, put the coding tool’s source code on GitHub the same day. It says it has removed the Repo Wiki feature. It has also disabled the workflow that generated and uploaded local repository snapshots, and shipped the fix in ZCode v3.14.0.
Two outside bodies checked the result. The China Academy of Information and Communications Technology found the zcode-prod Alibaba Cloud storage bucket in what Z.ai calls a zero-data state. The security firm NSFOCUS reported that the bucket and every object in it had gone. Z.ai says the code never went near its training data. It has promised a full assessment report.
TNW reported last week that only Z.ai could open the files it had taken. That left only Z.ai able to say they were gone. The company has now answered that, and the answer has a gap in it. The researcher who found the problem is the one pointing at the gap.
What ferstar actually found
The developer who broke this writes under the name ferstar. He published his analysis on 18 September. In a local ZCode checkpoints directory he found a 313MB encrypted snapshot of a commercial project. Its status log recorded 564 failed upload attempts. The archive itself never made it off his machine, and sat in pending status.
The snapshot held 42,411 files. Git directories accounted for 86.6% of it. That breaks down as 196.1MB of large-file cache, 102.2MB of Git objects carrying the full commit history, and a slice of reflog. One smaller snapshot did reach the server: a public repository of 538 files, which compressed to about 15KB.
Two triggers drove the capture. One fired before each prompt the user submitted. The other ran as a Repo Wiki update task. ZCode encrypted file contents with AES-256-CTR, then wrapped the symmetric key with RSA-OAEP-SHA256. The public key came from Z.ai’s servers, so the private key stayed on Z.ai’s side.
Two settings looked like they would stop it. Neither did. Both governed what happened to the data downstream rather than whether ZCode took the snapshot, and ferstar found that capture running unconditionally. The privacy policy described collecting conversation text and files. It said nothing about automatic workspace snapshots carrying full Git history.
The verification problem moved rather than closed
Ferstar went back on 21 September, once the code was public. He confirmed the good news first. The upload pipeline has gone completely, and the checkpoint mechanism left behind does only local Git work, with no path to the cloud.
Then he found the rest. The published repository carries two commits. The development history is gone, and so is the code that did the uploading. The tool can now be inspected. What it used to do cannot. That is the original complaint in a new shape: a deletion claim that rests on the word of the party who deleted.
One of the loudest claims was withdrawn
On Friday a Chinese firm called Chengming Technology said six of its coding workspaces had gone to the cloud without consent. It listed complete source code, database passwords and employees’ personal information. No other named company had alleged anything that serious.
On Monday Chengming withdrew the statement, saying it had relied on wrong evidence, Reuters reported. The firm did not immediately respond to Reuters’ request for comment. Z.ai referred the agency to its public statements. Laurie Chen’s report also records Friday’s Z.ai statement, which named a Codebase Indexing feature, on by default, as the origin.
The same thing happened in July, to a US tool
ZCode is not the first coding assistant caught shipping whole repositories. In July, Grok Build uploaded entire Git repositories, secrets included, and xAI promised a purge.
The symmetry runs both ways. Alibaba banned Claude Code in July over what it alleged was covert tracking of Chinese users. Chinese state bodies went further and called the mechanism a serious threat. The complaint then was that a foreign coding tool sent data home without consent. The complaint now is that sentence with the countries swapped.
Where Z.ai sits
Z.ai spun out of a Tsinghua University research lab in 2019. It ranks among the most heavily funded model developers in China. Its founder has argued publicly that frontier AI should be open to everyone, which is part of why the wiped commit history has landed the way it has.
Last month the company said its GLM-5.3 model approaches Anthropic’s Mythos at finding software vulnerabilities. It held the release for a two-week review, becoming the first Chinese lab to delay a model publicly on safety grounds. China’s cyber regulator published an updated AI safety framework last week, warning about shutdown resistance, evaluator deception and sandbox escape.
What Z.ai ZCode still has not answered
The full assessment report has not appeared, and Z.ai has given no date. Nobody has said how long ZCode behaved this way before 18 September. Nobody has said how many workspaces it captured. The two assessments describe the storage bucket after the fix, not what passed through it before.
We welcome developers to continue reviewing ZCode and reporting potential issues, and we will provide rewards based on the severity of the issues reported.
That is a bug bounty in everything but name. The first person to test it has already published his verdict on the fix. It was half favourable.
Get the TNW newsletter
Get the most important tech news in your inbox each week.
