Z.ai has open-sourced its ZCode coding agent after researchers found the software packing entire workspaces, including Git history, into encrypted snapshots destined for Alibaba Cloud.
- Z.ai open-sources its ZCode coding workbench under Apache-2.0 licensing after researchers expose hidden workspace telemetry uploading to Alibaba Cloud.
- Captured client archives contained 42,411 files, with private Git histories and Large File Storage records accounting for 86.6% of data.
- Third-party security auditors verify bucket deletions, but the absence of public audit logs leaves past enterprise repository exposure unverified.
The move came three days after security researcher ferstar published an analysis of ZCode’s desktop client. The analysis found that a logged-in client could package a workspace containing .git history, Git Large File Storage data and reflogs before encrypting the archive and sending it toward Alibaba Cloud Object Storage Service (OSS).
One captured snapshot contained 42,411 files, with .git accounting for 86.6% of the payload. Ferstar later clarified that the 313 MB encrypted archive generated from a commercial workspace failed 564 upload attempts and did not leave the local network. A separate archive of about 15 KB was accepted by the server.
The captured snapshot included Git objects, logs and LFS data, along with source and configuration files. Git history can contain material that is no longer present in the current working tree, including deleted files and earlier versions of code.
ZCode Encrypted the Snapshot Before Upload
Ferstar’s analysis found that ZCode encrypted the archive locally with AES-256-CTR. The encryption key was then wrapped using an RSA-OAEP public key supplied by Z.ai’s server. The corresponding private key was not stored on the user’s machine, according to the analysis.
Have a development worth tracking?
Share product launches, funding announcements, partnerships, research findings and market developments with The Grey Terminal's readership.
→ Submit a Press ReleaseZ.ai said the behavior was connected to ZCode’s codebase-indexing system and Repo Wiki feature. The company said the features were designed to support functions including repository documentation, historical checkpoints and version restoration. On Sept. 18, Z.ai acknowledged the issue and said relevant upload data was destroyed after processing.
Ferstar’s analysis found that turning off Repo Snapshot Indexing did not prevent the snapshot process in the version examined. The setting controlled server-side indexing rather than the underlying capture path.
Z.ai Removed the Upload Path
On Sept. 21, Z.ai said it had completed its remediation, apologized to users and released ZCode under the Apache-2.0 license.
The public ZCode repository describes the software as an AI coding workbench with desktop, web and terminal interfaces. Its package metadata identifies version 3.14.0, and the public GitHub repository contains two commits.
Z.ai said version 3.14.0 removed Repo Wiki and the repository snapshot generation and upload paths. The company also said it invited the China Academy of Information and Communications Technology (CAICT) and cybersecurity firm NSFOCUS to review the changes.
According to Z.ai, CAICT found the zcode-prod Alibaba Cloud OSS bucket in a zero-data state, while NSFOCUS found that the bucket and its objects had been deleted. Z.ai also said the affected code data was not retained or used to train its models. As of Sept. 22, the full CAICT and NSFOCUS audit reports had not been published.
The public repository provides a way to inspect the repaired client. Its two-commit history does not provide a development record of the earlier snapshot mechanism, however. Ferstar’s review of the new code found that the components responsible for the previous upload path had been removed.
The public record does not establish how many pre-fix snapshots were successfully accepted, whether any were accessed, or whether copies existed outside the zcode-prod bucket.
ZCode’s code is public now. The historical data trail is not.
Activate Terminal Layer
Structural analysis of the systems, pressures, and stakeholders behind this story.
