Product1 publisher3 min readPublished
Z.ai open-sources ZCode with the uploading code gone from a two-commit history
Two outside bodies reported ZCode's cloud storage bucket empty, and the researcher who found the problem confirms the upload pipeline is gone. The repository Z.ai published holds two commits and not the code that did the uploading.
The Product Desk · Product desk
What happened
- Z.ai, the Beijing company formerly known as Zhipu, put ZCode's source code on GitHub on Monday, the same day it apologised on the coding tool's official account.
- The company says it removed the Repo Wiki feature and disabled the workflow that generated and uploaded local repository snapshots, shipping the fix in ZCode v3.14.0.
- The China Academy of Information and Communications Technology found the zcode-prod Alibaba Cloud storage bucket in what Z.ai calls a zero-data state.
- The researcher ferstar published an analysis on 18 September describing a 313MB encrypted snapshot of a commercial project in his local ZCode checkpoints directory, logged with 564 failed upload attempts.
- Rechecking the published code on 21 September, ferstar found the repository carrying two commits, without the development history or the code that did the uploading.
Compiled by The Product DeskSomething wrong?How this is made
Why it matters
- exposure Users who had switched off both of the settings that appeared to govern this were still being snapshotted before v3.14.0, so the set of teams that needs to go through its own logs is larger than the set that agreed to anything.
- decision A security team can pin ZCode at v3.14.0 and read a checkpoint mechanism that now does only local Git work; accepting that the old uploads are deleted is a separate decision, taken on other people's inspections.
- constraint Reading the published source no longer tells a customer what its own workspaces sent, because the uploading code is not in it.
- precedent Two outside inspections of a storage bucket is a higher bar than xAI set in July, when Grok Build uploaded entire Git repositories including secrets and the company answered with a promised purge.
Most of what ZCode captured was project history. The archive held 42,411 files, and Git directories accounted for 86.6% of it: 196.1MB of large-file cache, 102.2MB of Git objects carrying the full commit history, and a slice of reflog [9][10].
Two of the product's settings looked like they would stop that. Both governed what happened to the data downstream, and neither decided whether ZCode took the snapshot; ferstar found the capture running unconditionally [15]. One trigger fired before every prompt the user submitted, and the other ran as a Repo Wiki update task [12]. Z.ai's privacy policy described collecting conversation text and files, and did not mention automatic workspace snapshots carrying full Git history [16].
ZCode encrypted file contents with AES-256-CTR, then wrapped the symmetric key with RSA-OAEP-SHA256 [13]. The public key came from Z.ai's servers, so the private key stayed on Z.ai's side [13]. TNW reported last week that only Z.ai could open the files it had taken [14].
Z.ai wrote on ZCode's official account: "In response to the ZCode product security issues reported by the community, we have completed the necessary remediation and sincerely apologize to all our users." [1] NSFOCUS, the second outside checker, reported that the bucket and every object in it had gone [5]. The company says the code never went near its training data [6].
The scope of what actually left users' machines rests on one published measurement, ferstar's. The snapshot that did reach the server was a public repository of 538 files, compressed to about 15KB [11]. The archive that failed to upload 564 times is roughly 21,000 times that size [1]. His own numbers for that archive leave some slack: the two components he itemised come to 298.3MB, while 86.6% of a 313MB archive is about 271MB [3].
The most serious allegation against ZCode is no longer on the record. Chengming Technology said on Friday that six of its coding workspaces had gone to the cloud without consent, listing complete source code, database passwords and employees' personal information [19]. On Monday the firm withdrew the statement, saying it had relied on wrong evidence, Reuters reported, and Z.ai referred the agency to its public statements [20]. Laurie Chen's report also records Z.ai's Friday statement, which named a Codebase Indexing feature, on by default, as the origin [21].
For whoever has to decide this week whether ZCode stays in the toolchain, a cleanup claim can be checked on three points: which release carries the fix, who besides the vendor looked at the storage, and whether the code that did the collecting can still be read. ZCode answers the first two [3][5]. The third answer would have to come from the full assessment report Z.ai has promised [6].
What to watch
- Whether Z.ai restores ZCode's development history or publishes the pre-v3.14.0 upload code for inspection.
- Whether the China Academy of Information and Communications Technology or NSFOCUS publishes its bucket findings under its own name.
- Whether any other customer produces logs showing a successful snapshot upload, now that Chengming's account has been withdrawn.