A developer writing as ferstar was clearing space on a MacBook Air when he found a 313 MB encrypted archive in the local data directory of ZCode, Zhipu’s AI coding tool. It held a snapshot of a commercial project he had opened in the app. The client had tried to upload it 564 times, according to his investigation. The archive exceeded the size limit and stayed in the local retry queue. A separate snapshot of a small public repository, containing 538 files and weighing about 15 KB after compression and encryption, was marked as accepted by the server.
Table of Contents
The archive waiting on a MacBook
The distinction matters because the largest file in the story is the one the developer says stayed on his machine. The smaller archive provides evidence that the upload path was active. The investigation, published on September 18, 2026, describes what happened on one developer’s machine. It also gives other users a concrete place to look for evidence: the client’s own records of which workspaces it prepared and how those transfers ended.
Two snapshots from the same investigation
| Workspace | What ferstar observed |
|---|---|
| Commercial project | 313 MB encrypted archive remained in the local retry queue after 564 failed attempts |
| Public repository | 538 files packed into about 15 KB, with the server recorded as having accepted the upload |
The recorded outcomes establish a failed transfer and a successful one in the same investigation. The developer’s records give no count of affected ZCode users or private repositories across the service.
The snapshot reached into Git history
In the older client, version 3.12.3, ferstar traced a workflow that requested upload credentials from a ZCode server, compressed the workspace, encrypted the archive and sent it directly to Alibaba Cloud Object Storage Service. The client encrypted the archive with an AES key and wrapped that key using an RSA public key supplied by the server. A party with the corresponding private key could unwrap the archive key. The scheme protected the payload in transit and storage while leaving decryption possible for whoever controlled that private key.
In one snapshot inventory examined by ferstar, 86.6% of the bytes were under the project’s Git metadata directory. That included the local Git LFS cache, Git’s object database and reflog records. The figure describes a single inventory. It explains why a snapshot can expose material that a developer no longer sees in the editor. A credential deleted from today’s source tree can still appear in an earlier commit. Local branches and cached assets can add material that a remote repository or a clean checkout would never contain.
The controls in the older build compounded the problem. Ferstar reported that the experience improvement switch governed permission for training, while the repository snapshot indexing switch governed whether the server indexed a snapshot. In his review, disabling both left the archive creation and upload path intact. A developer concerned about keeping a repository on the machine could therefore change both settings and still face an attempted transfer.
A company asked Zhipu to account for its data
InfoQ reported that Taiyuan Chengming Technology sent Zhipu a formal letter after investigating its own ZCode installations. The company said the transfers were automatic and that the archives it identified could include project code, version history, database passwords, cloud credentials and employee information. InfoQ confirmed with a company spokesperson that the letter was sent. The evidence behind those allegations was the company’s own investigation, separate from the two snapshots described by ferstar.
The letter requested a written response by October 10. It asked Zhipu to account for where the data went, who handled it, whether anyone accessed or exported it and how deletion was verified. It also raised the possibility of cross-border processing based on the company’s observations about certain network requests. The reviewed reporting establishes that Chengming asked the question. It does not establish that the archives were stored abroad or that the allegations resulted in a regulatory finding. No public written reply addressing the letter was identified in the sources reviewed for this article.
The fix closed the upload path
On September 18, Zhipu apologised and said the uploads were tied to Repo Wiki, a feature that generated repository documentation in the cloud and was initially enabled by default. The company said the input data was destroyed after the wiki was generated. Ferstar’s review of the older build described snapshot capture hooks attached to ordinary prompts as well as wiki updates. That difference leaves the exact historical trigger conditions an important part of the record.
Zhipu said version 3.14.0 removed Repo Wiki and the snapshot generation and upload workflow. Ferstar’s inspection of the updated client and a separate review of the published source both found the old upload path gone. Zhipu also published the ZCode source on GitHub. The public repository gives developers something they can inspect when assessing the repaired product. The GitHub entry for version 3.17.2, posted on November 4, identifies the build’s source commit and provides checksums for the downloads.
Evidence for the fix and the cleanup
| Question | What the reviewed sources establish |
|---|---|
| Was the upload path removed? | Zhipu announced its removal in 3.14.0. Separate client and source inspections found the old path absent. |
| What happened to the named storage bucket? | Zhipu said CAICT found it empty and NSFOCUS verified deletion of the bucket and its objects. |
| Was the data used for training? | Zhipu said it had never used the relevant code data for model training. |
The storage findings concern a specific destination. The statements reviewed give no repository-by-repository account of what arrived there, what was decrypted or who accessed it while it existed.
Opening a project gave the app room to do more
A cloud coding assistant may need a file to answer a prompt. A local checkpoint can also be useful when an agent makes changes a developer wants to undo. The ZCode case shows where those ordinary features can create a much larger transfer. The scope of a prompt, the scope of a checkpoint and the scope of an upload are three separate decisions. A developer who asks a question about one file needs a way to see when a tool is about to send the repository’s history along with it.
For an engineering team reviewing this incident, the useful test is concrete. Open a disposable repository with harmless markers in the working tree and in old commits, then observe what the tool prepares and which destinations it contacts when indexing, checkpointing and cloud features are toggled. An outbound connection alone cannot identify the contents of an encrypted payload. Client logs, a snapshot inventory and transfer status can give the team a more precise record. In ZCode’s case, that distinction is exactly what separated a commercial archive waiting on disk from a public repository snapshot the server had already accepted.
Author:
Jan Bielik
CEO & Founder of Webiano Digital & Marketing Agency
This article is an original analysis supported by the sources cited below
Inside ZCode: Silently Uploading Your Entire Git History to the Cloud
The original developer investigation documents the two transfer outcomes, the snapshot contents, the encryption workflow and the behaviour of the older client’s controls.
比 Grok、Cursor 都狠？智谱 ZCode“偷传代码”风波升级，企业发函追责
InfoQ reports the discovery, verifies that Chengming sent its letter and describes the questions the company raised.
智谱 ZCode 被质疑“偷传代码”：官方回应称问题已修复，将开源代码库、引入第三方审查
IT Home reports Zhipu’s September 18 apology and its explanation of the default Repo Wiki behaviour.
智谱ZCode代码上传风波持续：开源整改回应信任危机，百万用户AI编程业务迎安全考验
National Business Daily reports the company’s training statement and its account of the CAICT and NSFOCUS checks.
Is ZCode safe? What the open-sourced code shows
Juan Jiménez Suárez documents a separate review of the published source for the old upload route and archive packaging code.
Releases · zai-org/ZCode
ZCode’s public GitHub release page records subsequent builds and links release entries to source commits.
Zhipu’s ZCode deletes data and announces compensation after data upload controversy
TechNode covers the subsequent company announcement about deletion of the affected bucket and its objects.
| Citing this article? Brief excerpts are welcome. Please credit Webiano.digital, name the author where stated, and include a link to https://webiano.digital and to this original article. Full or substantial republication requires prior written permission. Read our Copyright and Content Use Policy. |
This article was prepared with the assistance of artificial intelligence tools. The content underwent expert human review, and Webiano Digital & Marketing Agency assumes editorial responsibility for its final version and publication.
