ZCode Uploaded Code to Cloud With Encryption Key Users Couldn’t Access

👁 114 reads

564 - that’s how many times the file tried to upload before Ferstar even noticed it existed. The Chinese developer looked into ZCode’s local application directory on Friday and found a 313-megabyte encrypted archive waiting in the queue for shipment to Alibaba’s servers. A smaller file had already been sent.

He couldn’t look inside his own archive. And that’s the detail that elevates this whole affair beyond the category of an ordinary privacy complaint.

An Archive the Owner Can’t Open

Ferstar described the situation publicly: the archive contained a snapshot of a commercial project he was working on, along with the full Git repository history. The private key needed for decryption sat on Z.ai’s servers - neither he nor any ZCode user had access to it. The upload option was enabled by default and - as Ferstar claimed - there was no button to turn it off. Independently, blogger Feng Ruohang wrote that same Friday that he saw at least three uploaded files in his logs. The story was first reported by Minxiao Chang and Wency Chen for South China Morning Post.

The 313 megabytes itself is the least interesting number in this story. The .git directory in a repository doesn’t just contain current files - it keeps every change since the project began. Credentials that someone once accidentally committed to history and later revoked remain. So do abandoned branches, internal hostnames, and commit messages that no one wrote thinking anyone outside would ever read them. This is a different order of sensitivity than an ordinary working file.

Bug or Designed Feature

Z.ai apologized on Friday in an official Feishu channel and announced the problem had been resolved. The statement, reprinted in full on V2EX, points to a repository indexing feature in ZCode that serves to restore sessions after crashes, roll back versions, and generate so-called Repo Wiki. According to the announcement, generating a Wiki page in the cloud could trigger uploading the entire repository - and this option was active by default immediately after the product’s launch.

This is a description of something designed, not something broken. The difference is fundamental. You patch a bug. Someone had to choose a default setting beforehand.

“The source code indexing feature supports session checkpoint restoration, version rollback, and Repo Wiki. Generating a Wiki page could trigger repository upload.”

- excerpt from Z.ai’s official statement

Z.ai added that uploaded data is destroyed immediately after generating the Wiki page and is not stored. In a Saturday update, Ferstar asked: how is anyone supposed to verify that? The question contains its own answer. Z.ai built the archive in such a way that only Z.ai can read it - so only Z.ai can say what happened to it.

Privacy Policy That Didn’t Anticipate This Scenario

We looked into ZCode’s privacy policy. It’s been in effect since June 15 and hasn’t been changed since. The document says the service collects text, files, and code uploaded by the user through conversation. A packaged snapshot of an entire repository with Git history is not something a user uploads in conversation with an assistant - it’s something the application does on its own, in the background, without an explicit act of will on the user’s part.

The permissions table in the policy covers network and storage access but doesn’t describe any repository snapshotting mechanism. The only data control the document explicitly mentions is the Optimization Program - disabled by default, governing whether content goes to training models, not whether it’s uploaded at all.

A developer who read the policy and disabled training had no reason to expect anything else.

This isn’t the first time a coding tool turned out to send more than it declared. Earlier, a similar situation involved Grok Build from xAI, which uploaded entire Git repositories to the company’s servers despite marketing materials assuring the opposite. That case had one important difference, though: users could at least check network traffic logs and see what exactly went out. In ZCode’s case, the data was encrypted with a key the code’s owner never held.

Coding agents are a harder security problem than chatbots. They have access to entire repositories, change histories, environment variables, and API keys. The gap between what you entrust them with and what’s actually audited has been a structural weakness of the industry for some time now - a separate researcher recently managed to take control of Claude Code simply by asking it to summarize a web page.

Z.ai says the data has been deleted. We have to take the word of the company that was the only one with the key.

// read moreGrok leaks user data when malicious instructions hidden in encryptionNewsMeta Muse Creates Profiles of Your Friends Without Their ConsentNewsMETR API Key Stolen: $600K in AI Credits DrainedNews