Z.ai Open-Sources ZCode After Silent 313MB Workspace Upload

Z.ai's ZCode coding agent silently packaged 42,411 files from one developer's workspace into a 313MB encrypted archive and made 564 failed attempts to ship it to Alibaba Cloud, according to Tom's Hardware.

The finding came from a researcher publishing as ferstar. In a reverse-engineering write-up dated September 18, ferstar traced the client requesting upload credentials from zcode.z.ai, receiving an RSA public key and Alibaba Cloud object-storage form signatures, and encrypting the payload with AES-256-CTR before shipping it. The .git directory accounted for 86.6% of the archive; Git LFS caches alone came to 196.1MB, and .git/objects another 102.2MB.

"The corresponding private key was held on the server side, leaving the local user and the ZCode client unable to decrypt the ciphertext stored on the user's own computer," the analysis reported.

The privacy controls did not stop it. Z.ai's "Repo Snapshot Indexing" and "Optimize Experience" toggles, ferstar found, "only control whether data is authorized for model training"; local packaging and upload continued regardless. One active session generated 62 capture events triggered before prompts and after task completion.

Z.ai, the firm behind the GLM models, apologized, open-sourced ZCode under Apache 2.0 on September 21, and said the collected data had been destroyed. Users cannot verify that claim from the released client alone.