Z.ai has acknowledged the incident as resolved, attributing it to a repository indexing feature that shipped enabled by default. The feature was designed to support session checkpoint recovery, version rollback and a Repo Wiki.

Discovery and scope

On Friday, developer Ferstar inspected ZCode's local directory and discovered a 313MB encrypted archive queued for upload to Alibaba's cloud storage. The upload had failed 564 times. A second, smaller file had already been transmitted. Minxiao Chang and Wency Chen reported the findings for the South China Morning Post.

The archive contained a snapshot of a commercial project including its complete Git history. Ferstar noted that neither he nor the ZCode client could decrypt the file, since the private key resides on Z.ai's servers. No toggle existed to disable the upload feature.

Why Git history matters

A repository's Git directory preserves every modification since the project's inception—a fundamentally different dataset than the current working files. This historical record often contains credentials that were committed and later revoked, abandoned branches, internal hostnames and commit messages never intended for external eyes.

This distinction elevates the security implications beyond typical privacy concerns. Coding agents present a harder security challenge than chatbots, and researchers have already demonstrated vulnerabilities: one hijacked Claude Code simply by requesting a webpage summary.

Feature or bug?

Z.ai's official statement, posted to its Feishu community and reposted on V2EX, describes the repository indexing feature as intentionally designed. Generating a Wiki page in the cloud could trigger the upload, and the feature remained active by default following launch. This framing matters: bugs receive patches, while defaults are deliberate choices made by someone.

The verification problem

Z.ai stated that uploaded data is destroyed immediately after Wiki page generation and is not retained. Ferstar posed a critical question in a Saturday update: how can anyone verify this claim?

The answer is self-evident. Z.ai encrypted the archive so that only Z.ai could read it, which means only Z.ai can report what happened to it. No independent verification is possible.

What the privacy policy says—and doesn't

ZCode's privacy policy, effective 15 June and unchanged since, states that the service collects text, files and code submitted through conversation. A packaged repository snapshot is not something a user submits through conversation. The policy's permissions table addresses network and storage access but documents no repository snapshotting capability.

The sole data control documented is the Optimization Program, disabled by default, which governs whether content trains models rather than whether content gets transmitted. A developer who read the policy and left the training toggle untouched had no reason to anticipate any of this behavior.

A precedent with a better outcome

Grok Build uploaded entire Git repositories to xAI's servers despite marketing claiming no codebase content was transmitted during sessions. The privacy toggle designed to prevent this did nothing.

Chinese developers drew this parallel within hours of Z.ai's statement. The response from xAI offers a template: Elon Musk confirmed the uploads, xAI deleted prior user data, documented a zero retention policy and added a privacy endpoint. A subsequent retest on the same client confirmed uploads had stopped. That verification step transforms a statement into fact—a step Z.ai has not yet taken.

Open models, closed software

Z.ai has built its market position on releasing models freely. The company approaches $1bn in annual sales while giving away its best models, making the paid product the software layer surrounding them.

This structure exposes a fundamental asymmetry. The model weights are inspectable, but the client reading the disk was not. Founder Tang Jie has contended that safety emerges from broad participation and oversight rather than technical restrictions. That argument did not extend to the software installed on developers' machines.

Immediate consequences

A software engineer at a major Chinese robotics company, speaking anonymously due to lack of authorization, told the Post that their employer has prohibited Z.ai tools internally over security concerns.

A Shanghai developer using the handle Tuxi suggested the damage would primarily affect community trust rather than the models themselves. GLM functions through other coding tools, including OpenAI's Codex, allowing users to abandon the client without abandoning the model.

What comes next

  • Whether the open-sourcing initiative covers the uploader component. Z.ai has pledged to release ZCode's codebase and invite third-party assessors, but the question remains whether the workspace packaging component will be included.
  • An independent retest. Someone outside the company confirming on the same client that uploads have ceased would carry more weight than any statement.
  • Privacy policy updates. The current policy still describes files submitted through conversation and has remained unchanged since Friday.

Source: The Next Web