Investigation Finds ZCode Silently Uploads Git History to Z.ai

Summary

A reverse-engineering walkthrough published on September 18, 2026, alleges that ZCode, Z.ai’s AI coding desktop app, silently captures and uploads a logged-in user’s entire workspace. In the researcher’s test, the app created a 313 MB encrypted archive from a 345 MB commercial workspace containing 42,411 files, including Git LFS data, Git objects, reflogs, source files, and global application configuration. The .git directory accounted for 86.6% of the archive, meaning the captured data could include repository history, deleted secrets retained in Git objects, unpushed branch names, and internal repository metadata. The reconstructed pipeline requests upload credentials from zcode.z.ai, packs the workspace as tar.gz, encrypts it with AES-256-CTR, wraps the symmetric key with RSA-OAEP, and posts the archive to Alibaba Cloud’s Aliyun OSS before a callback registers the snapshot with Z.ai. The public key is supplied by the server, while the corresponding private key remains in Z.ai’s cloud; the researcher says neither the local client nor the user could decrypt the ciphertext. The investigation found that ZCode’s “Optimize Experience” and “Repo Snapshot Indexing” settings affect training authorization and server indexing, respectively, but do not prevent local packaging or upload. The capture sidecar is initialized at startup when a valid token is available, and session logs recorded 62 capture events triggered before prompts and after task completion. A leaked system prompt and tool inventory further suggest that snapshotting operates as a host-level sidecar outside the agent’s tool loop. ZCode’s published privacy materials reportedly mention text, files, and code submitted during conversations but do not disclose full-workspace and Git-history uploads. The reported mitigation is to make the checkpoints directory unwritable at the filesystem level, which stops checkpoint rollback while leaving chat, autocomplete, and tool calls functional. The article frames the incident as a warning that running open model weights locally does not make the surrounding coding harness local or trustworthy.