Security 1 publisher2 min readPublished September 23, 2026 at 11:41 AM PDT

ZCode uploaded whole workspaces to Aliyun OSS under a key only its server holds

A researcher at blog.ferstar.org found Zhipu's AI coding desktop app packaging .git history, reflogs and LFS caches into encrypted archives bound for Aliyun OSS, with the private key kept in the vendor's cloud.

The Watch · Security desk

What happened

A researcher at blog.ferstar.org found that Zhipu's ZCode desktop app packaged whole workspaces, including complete .git history, reflogs, LFS asset cache and global app configs, and uploaded them to Aliyun OSS.
Encryption used an RSA public key the server delivered at upload time, with the private key held only in the cloud, leaving hundreds of megabytes of ciphertext that neither the user nor the client could open.
ZCode posted an official statement on X at 09:23 on September 21, 2026 and published what it called its open-source core at GitHub zai-org/ZCode under Apache-2.0.
That repository holds two commits, an empty one and a 6,973-file dump of 1.03 million lines, with the internal development history flattened, pull requests locked and issues closed.
Client v3.14.3 shipped on the evening of September 23 with a matching public commit, and unpacking its app.asar shows zero occurrences of the repoSnapshot logic.

Compiled by The WatchSomething wrong?How this is made

Why it matters

exposure The unit uploaded was the repository plus the developer's global app configs, so a single signed-in session moved far more than whatever file the model had been asked to read.
constraint Anyone doing incident response on an affected laptop can measure the archives and nothing more, because only the party that collected them can read them.
contradiction The upload pipeline was captured in the shipped client, yet searches of the published code return zero matches for it, and the flattened commit history offers no diff that dates its removal.
decision Allowing the app means trusting that a compiled binary matches a published tree; the read-only directory lock is the one control that does not depend on that trust.

The captured path is short. The client asks `/api/v1/snapshot/upload-credential` for credentials, packages the workspace with AES-256-CTR, and PostObjects the result straight to Aliyun OSS ^[4]. The investigation started as disk cleanup, after `~/.zcode` passed 700MB ^[1].

For this to work, the app had to hold a read across the whole workspace and a logged-in session to the vendor's cloud. ZCode held both, and the snapshot ran whenever the user was signed in ^[2].

The September 23 release gave the first chance to compare a shipped build against a published commit. The author audited the 282 files changed in `328c1a0` and found the upload-credential endpoint and the AES-256-CTR packaging still absent ^[12]. `gitCheckpointService.ts` does its diffing through the local Git CLI with no cloud calls ^[13]. On the machine, process logs and `~/.zcode/v2/checkpoints/` showed the workspace going unscanned and unpackaged, with no new `.enc` archives ^[16]. Those 282 files are about four percent of the 6,973 published in the initial dump ^[1].

The post stops short of calling the binary clean. "matching version tags does not guarantee a 1:1 identical match between proprietary compiled binaries and public source code", the author wrote, and recommends keeping the ZCode directory read-only as the baseline defense ^[17]^[18].

Most of the new code in 3.14.3 is remote control. It adds IM bots for WeCom, Feishu, DingTalk and Telegram, plus workflow execution optimizations ^[14]. An agent that accepts instructions over four messaging platforms deserves the same traffic capture that found the snapshot path.

The vendor's own account is thin in the record. The post references the X statement and the third-party evaluation the company cited without reproducing either ^[19], and notes that the repository wiki was scrubbed down to a single external Wikipedia reference ^[10].

What to watch

Whether Zhipu states how long snapshot uploads ran, how many workspaces were collected, and whether the OSS objects and the cloud-held private key are deleted.
A byte-level or reproducible-build comparison tying the shipped 3.14.3 binary to commit 328c1a0.
Whether the new WeCom, Feishu, DingTalk and Telegram control channels in 3.14.3 get the same traffic review as the snapshot path.

Claim ledger

Ranked by verification strength, evidence, and original report placement.

[15]
The local desktop application updated to 3.14.3, and unpacking the packaged assets (app.asar) shows zero occurrences of repoSnapshot logic.
ReportedSupported2 sources— sign in to open View cited source
[16]
Real-time process logs and the ~/.zcode/v2/checkpoints/ directory confirm no whole-workspace scanning, packaging or new .enc archive generation in v3.14.3.
ReportedSupported2 sources— sign in to open View cited source
[1]
The investigation began during a routine check to free up disk space, when the ~/.zcode directory was found to be taking up over 700MB.
ReportedSupportedView cited source
[2]
Whenever the user is logged in, ZCode (Zhipu's official AI coding desktop app) silently packages the entire workspace, including complete .git history, LFS asset cache, reflogs and global app configs, encrypts it, and uploads it directly to Aliyun OSS.
ReportedSupportedView cited source
[3]
The RSA public key used for encryption is delivered on the fly by the server while the private key lives exclusively in the cloud; the user cannot decrypt the multi-hundred-megabyte ciphertext sitting on their own disk, and neither can the ZCode client itself.
ReportedSupportedView cited source
[4]
The investigation captured a /api/v1/snapshot/upload-credential endpoint, direct PostObject OSS uploads, AES-256-CTR encryption and server-side public key delivery.
ReportedSupportedView cited source
[5]
On the morning of September 21, 2026 at 09:23, ZCode officially posted a statement on X and published what it described as its open-source core repository at GitHub zai-org/ZCode, licensed Apache-2.0.
ReportedSupportedView cited source
[6]
The published repository contains only two commits: an empty initial commit followed by a single 'feat: open source' commit dumping 6,973 files and 1.03 million lines of code; the internal development commit history was entirely flattened, pull requests were locked and issues closed, making it a one-way code dump.
ReportedSupportedView cited source
[9]
Searching the published codebase for the previously captured /api/v1/snapshot/upload-credential, direct PostObject OSS uploads, AES-256-CTR encryption and public key delivery returned zero matches; the pipeline was stripped clean with not a single line remaining.
ReportedSupportedView cited source
[10]
The repository wiki was thoroughly scrubbed, leaving an external Wikipedia reference.
ReportedSupportedView cited source
[11]
On the evening of September 23, 2026, ZCode pushed client v3.14.3 and the public repository followed with a matching commit, 328c1a0 'feat: update v3.14.3'.
ReportedSupportedView cited source
[12]
The author audited the 282 changed files in that commit and found the previously captured /api/v1/snapshot/upload-credential and AES-256-CTR packaging pipelines remain completely absent.
ReportedSupportedView cited source
[13]
The checkpoint mechanism in gitCheckpointService.ts continues to rely strictly on local Git CLI diffing with zero cloud dependencies.
ReportedSupportedView cited source
[14]
New code in the v3.14.3 commit primarily introduces multi-channel IM bots for remote control via WeCom, Feishu, DingTalk and Telegram, plus workflow execution optimizations.
ReportedSupportedView cited source
[17]
"matching version tags does not guarantee a 1:1 identical match between proprietary compiled binaries and public source code", the author of the blog.ferstar.org post wrote, adding that one cannot make absolute assumptions without byte-by-byte reproducible builds.
ReportedSupportedView cited source
[18]
The author writes that for any proprietary desktop app, keeping the read-only directory lock described in the post remains the most dependable baseline defense, and describes it as a one-liner that permanently shuts the upload down.
ReportedSupportedView cited source
[d1]
The 282 files changed in commit 328c1a0 are about 4 percent of the 6,973 files published in the initial open-source commit.
DerivedSupported1 source— sign in to open
[19]
The post says the source code was published alongside officially cited third-party evaluation findings, allowing official explanations to be cross-referenced against the codebase; it does not reproduce the text of the X statement or of the evaluation.
ReportedInsufficientView cited source

Sources

Publishers with included, body-backed reporting in this cluster.

blog.ferstar.org
1 article · September 23, 2026
Inside ZCode: Silently Uploading Your Entire Git History to the Cloud · Code is cheap, let's talk

Ask Clarity

Have a question this piece left open? The answer comes from its reporting and claim ledger — nothing else.

Try

Clarity analysis

How the coverage leans and what the record actually supports. Read the methodology

Perspective Coverage

How much of the coverage speaks to builders, operators and investors. It measures emphasis, not whether the story is right.

The parts of this report you can test yourself are the useful ones: the /api/v1/snapshot/upload-credential endpoint, AES-256-CTR packaging, and gitCheckpointService.ts running git diff --name-status against commit OIDs in the current workspace. That last file matters because session checkpoint rollback was the vendor's stated reason for uploading repository snapshots, and the published code does checkpoints with the local Git CLI and JSON metadata under ~/.zcode/checkpoints/. Ferstar also notes that code indexing reverted to bundled ripgrep and bfs. If you run ZCode, his read-only directory lock costs one command, and the published source he audited does not establish what the installed binary does.

Reality

Evidence, adoption, hype gap, incentives and confidence, each read independently from the current record on the scale shown beneath it. How these are measured.

Evidence55

0100

One first-hand audit, named artifacts

The detail is concrete for a single-author post: a named upload endpoint, a cipher mode, the source file where checkpoints are implemented, a commit hash, and file counts down to 6,973 and 282. All of it comes from one engineer's machine and one reading of a repository published with its history flattened. He says himself that version tags cannot prove the shipped binary matches the source, and Zhipu's own statement is described rather than quoted, so the vendor's explanation cannot be checked line by line here the way he says it now can be.

Adoption30

0100

Vendor's release cadence only

Two shipping events are documented: the 21 September repository publication under Apache-2.0 and the 23 September v3.14.3 client with a matching public commit. Neither tells us who uses ZCode. The repository arrived with pull requests locked and issues closed, so there is no contributor or fork activity to count either, and this reporting never reaches installs, downloads or affected repositories.

Topics and entities

Follow any of these and your For You feed starts watching them — no settings page required.

Topics

Entities

build
Grok 4.6 lands in Copilot two days after launch, and the model picker becomes a procurement problem
1 publisher
product
Z.ai's ZCode uploaded whole developer workspaces to Alibaba's cloud by default
1 publisher
build
Foundry offers Provisioned Throughput for two of the three GPT-6 models
2 publishers
build
The credential an agent inherits sets the ceiling on the damage
1 publisher

What happened

Why it matters

What to watch

Claim ledger

Sources

Let Clarity write the post for you.

Topics and entities

Topics

Entities

Related stories

Claim ledger

Let Clarity write the post for you.

Topics and entities

Topics

Entities

Perspective Coverage

Reality

Related stories

Sources