A reverse-engineering report published on 18 September found that ZCode, the desktop coding app from Chinese model lab Z.ai, bundles a developer's entire workspace β the complete Git object store included β and ships it to Alibaba Cloud object storage wrapped in encryption that only Z.ai's own servers can undo.
What makes the finding unusual is not the upload but the key custody. The archive lands on Alibaba's OSS as ciphertext the developer cannot open, produced by a process the app's settings screen never surfaces.
Key takeaways
- One captured snapshot held 42,411 files and weighed 313MB, with the .git directory alone accounting for 86.6 percent of the payload.
- ZCode wrapped each archive's AES-256-CTR key under an RSA public key issued fresh by the server, leaving the matching private key exclusively inside Z.ai's cloud.
- Z.ai has apologised, patched the client, granted ZCode users a one-off reset of weekly usage limits, and said it will open the codebase and invite outside auditors.
Why a Git directory is the worst thing to hand over
The researcher, who publishes as ferstar, unpacked the client's Electron bundle and rebuilt the transfer path step by step. On a 345MB commercial project, the resulting archive ran to 313MB across 42,411 files, and the repository's own object store made up the overwhelming bulk of it.
That ratio is the story. A working tree shows what a project looks like today; an object store preserves every state it has ever occupied. Credentials that were committed once and stripped in the next commit still sit in the history. So do abandoned branch names that telegraph unshipped features, and the internal hostnames and remote paths recorded in repository config.
Z.ai's published privacy terms describe collecting text and code. They do not describe collecting a repository's full lineage.
The toggles that looked like off switches
Anyone reading the report reaches for the preferences pane, and that is where the mechanism gets awkward. Cross-referencing the interface against the code, ferstar reported that the "Optimize Experience" switch governs only whether captured data may be used for model training, while "Repo Snapshot Indexing" governs only whether the server indexes what arrives. Neither touches packaging or transmission.
The capture component, according to the report, is instantiated by the host process at startup with no dependence on user preferences β the sole precondition is a valid session token. A single working session logged 62 capture events, fired ahead of each prompt and again when a task finished.
A second artefact reinforces the picture. A 131KB copy of ZCode's system prompt circulating in a public collection of harness prompts lists 31 tools available to the agent. None of them upload, snapshot or transmit anything, and across the whole document Alibaba, OSS and uploads go unmentioned. The exfiltration path sits outside the agent loop entirely, which is why no permission prompt ever fires.
Open weights are not an open harness
The episode landed hard partly because of a category error visible in the discussion threads: several developers assumed ZCode was open source because GLM is. Z.ai publishes downloadable weights; the desktop client that drives them is proprietary, and it is the client that does the packaging.
Reach was substantial in both languages, with ferstar's write-up passing 276,000 views and a Chinese-language warning thread drawing another 63,800. The most-quoted reaction came from developer Petri Kuittinen, who advised against trusting closed-source AI harnesses at all.
Z.ai's response arrived quickly. The company apologised, said the captured data was destroyed immediately after processing rather than retained, shipped a patch, compensated users with a usage-limit reset, and committed to publishing the ZCode codebase and bringing in third-party reviewers.
What this changes for developers
For teams weighing local model deployment against vendor desktop clients, the separation now looks sharper than it did. An open-weights release says what a model is; it says nothing about what the wrapper around it does with a filesystem. Any AI coding assistant with a checkpoint or rewind feature is, by construction, snapshotting something β and the question worth asking is where those snapshots come to rest. Similar scrutiny has followed other agent harnesses this year, including the zero-click vulnerability disclosed across four major CLI agents.
FAQ
Is ZCode open source?
No. Z.ai publishes the GLM model weights openly, but the ZCode desktop client is closed source, which is what allowed the snapshot behaviour to go unnoticed until someone decompiled it. The company has since said it intends to open the codebase.
Could a user decrypt their own uploaded archive?
No. The payload key was wrapped with an RSA public key supplied by Z.ai's server, and the researcher was unable to unwrap it using any private key present on the machine. The corresponding private key resides only in Z.ai's infrastructure.
Did disabling the privacy settings stop the uploads?
Not according to the report. The two relevant toggles controlled downstream use and server-side indexing, while the component that packaged and transmitted the workspace ran at host level regardless of those preferences.
