A 313MB archive nobody asked to send
Z.ai published the source code of ZCode, its coding agent, on Monday, three days after a paying subscriber showed that the tool had been packaging entire developer workspaces and uploading them to Alibaba’s cloud without asking.
The developer, who publishes as ferstar, documented the behaviour on 18 September. They found it while clearing disk space on a MacBook Air, noticing that the ~/.zcode directory had grown past 700MB. Inside was a snapshot of a commercial project: 345MB of files compressed to a 313MB encrypted archive, covering 42,411 files across their workspaces.
Most of it was Git history
Roughly 87% of the payload was the .git directory. By ferstar’s breakdown, the largest component was 196.1MB of LFS cache, followed by 102.2MB of commit objects and 0.6MB of reflogs. That is not a snapshot of the code a developer is working on. It is the project’s history, including every branch and every deleted state the repository still remembers.
The archive was encrypted before upload using envelope encryption — an AES-256-CTR content key wrapped with RSA-OAEP-SHA256 — and posted to Aliyun OSS after credentials were negotiated with Z.ai’s servers. The private key never reached the user’s machine. The practical consequence is that the developer could not open their own uploaded repository, and neither could the client that made it.
The toggles did not work
ZCode exposed two settings that sounded like they governed this: “Optimize Experience” and “Repo Snapshot Indexing”. Turning them off did not stop the capture, because the pipeline ran unconditionally once the app was logged in. Deleting the pending package did not help either: within half an hour, a fresh 313MB archive was built. One snapshot had accumulated 564 failed upload attempts before it was noticed.
The remediation, and what it cannot show
Z.ai says it has fixed the problem. Chief executive Zhang Peng said the company had completed the necessary remediation, according to RuntimeWire, and the company followed that by publishing the code.
The repository at github.com/zai-org/ZCode is Apache-2.0 licensed and covers the desktop application, the browser interface, the terminal agent, backend services, shared UI and the agent runtime. It was created on 20 September and opened with two commits — a consolidated code drop rather than the development history that would let anyone audit how the upload path was written or when it changed.
Z.ai’s own notice concedes the limit: internal processing performed after requests reach its gateway is outside the scope verified by the client repository. Publishing the client says what the software does now. It cannot say what happened to repositories already uploaded, whether they were deleted, or who inside the company could read them.
What to watch
The repository carries no SECURITY.md and no published advisories. Developers who used ZCode have no mechanism to confirm what was retained, and no way to verify that the distributed binaries match the published source without building and comparing them. Whether Z.ai answers either question is the test of whether open-sourcing was remediation or publicity.
