Z.ai Open-Sources ZCode After Report of Full Workspace Uploads to Alibaba Cloud

Z.ai has open-sourced its ZCode AI coding agent after a developer's reverse-engineering report found that the application could package entire workspaces, including Git history, into encrypted snapshots and upload them to Alibaba Cloud.

The findings were published Sept. 18 by developer ferstar, who analyzed ZCode's behavior and reported that the application could create snapshots containing a user's full workspace. Coin Bureau highlighted the findings in a post by Coin Bureau on X, noting that one analyzed snapshot contained 42,411 files, with the .git directory accounting for 86.6% of the payload.

The investigation raised concerns because Git history can contain files and development records that are no longer present in the current working directory. Ferstar reported that ZCode encrypted the snapshots before uploading them to Alibaba Cloud's object-storage infrastructure.

Reverse Engineering Exposed ZCode Snapshot Pipeline

Ferstar's investigation found that the affected ZCode client packaged workspace data into encrypted snapshots. The researcher reported that the mechanism included .git history, Git LFS assets and reflogs, rather than limiting the process to files directly required for a coding task.

In the analyzed snapshot, 42,411 files were included, with .git representing 86.6% of the payload. The finding was particularly notable because Git repositories can markets preserve historical versions of files and other metadata even after those files have been removed from the latest version of a project.

The report also said that disabling ZCode's “Repo Snapshot Indexing” setting did not stop the snapshot pipeline. Ferstar documented the behavior in the Sept. 18 report and subsequently examined the newer version released after Z.ai responded to the findings.

Z.ai acknowledged the underlying upload issue in a Sept. 18 statement, according to the investigation. The company attributed the behavior to codebase indexing and said the relevant issue had been fixed. It also said ZCode would be open-sourced and subject to third-party review.

ZCode Moves to Open Source After Security Controversy

Z.ai subsequently published ZCode's source code under the Apache 2.0 license. Ferstar's follow-up analysis found that the newly published code no longer contained the previously identified snapshot-upload pipeline, including references to the snapshot credential endpoint and direct object-storage upload mechanism.

ZCode's official release history also records a repository Wiki upload fix in version 3.14.0, released Sept. 19. The latest listed version, 3.14.1, was released Sept. 21.

The open-source release gives developers a way to inspect the current client-side implementation rather than relying solely on the application's behavior or documentation. financial However, the release does not independently establish what happened to data that may have been uploaded before the remediation.

That distinction remains central to the incident. Ferstar's investigation documented the former upload mechanism, while the subsequent source-code release demonstrates that the identified pipeline was removed from the published version. Whether previously uploaded snapshots were retained or deleted cannot be determined solely by inspecting the current client code.

Writer: Victoria Hale
Technology & Blockchain Writer

Victoria Hale writes about blockchain technology, digital infrastructure, and the intersection of emerging technologies with finance. Her articles explore how new protocols and systems are shaping the evolving digital economy.

She prioritises clarity and accuracy when explaining technical developments to a general audience.