A developer writing under the name Ferstar inspected ZCode's local directory on Friday and found a 313MB encrypted archive queued for upload to Alibaba's cloud storage. The transfer had already failed 564 times, and a smaller file had gone through. The archive contained a snapshot of a commercial project, including its Git history, and neither Ferstar nor the ZCode client could decrypt it, because the private key sits on Z. ai's back end. For any company running coding agents on proprietary code, this is the part that matters: the tool decided what left the machine, and the owner of the code could not read it.
What the archive contained and how it was found
Minxiao Chang and Wency Chen reported the account for the South China Morning Post. The upload was enabled by default and there was no button to turn it off, Ferstar said. Another blogger, Feng Ruohang, wrote on Friday that he had seen at least three files uploaded. Alibaba, which owns the South China Morning Post, did not respond to the Post's request for comment on Sunday. The size of the archive is the least informative number in the incident: a repository's Git directory holds every change since the project began, which is a different category of data from the files currently on disk.
Credentials that were committed and later revoked stay in that history. So do abandoned branches, internal hostnames and commit messages nobody expected an outsider to read. That is why coding agents are a harder security problem than chatbots: the gap between what these tools are trusted with and what they are audited for is already the industry's standing weakness, and a researcher has hijacked Claude Code simply by asking it to summarise a web page. A snapshot of a working repository therefore carries more exposure than the same developer's chat history, and it travels without any visible action on their part.
What this means for companies adopting coding agents
Z. ai apologised in its official Feishu community on Friday and said the problem was resolved. The statement, reposted in full on V2EX, traces the behaviour to ZCode's code repository indexing feature, which supports session checkpoint recovery, version rollback and a Repo Wiki. Generating a Wiki page in the cloud could trigger a repository upload, the statement said, and the feature was on by default in the period after launch. That is a description of something built rather than something broken, and the distinction decides what users should ask next: a bug gets patched, while a default gets decided by somebody.
Z. ai said the uploaded data is destroyed immediately once the Wiki page has been generated and is not retained. Ferstar asked in a Saturday update how anyone is supposed to verify that, and the question answers itself: Z. ai built the archive so that only Z. ai could read it, which means only Z. ai can report what became of it. TNW read ZCode's privacy policy, which took effect on 15 June and has not been amended since. It says the service collects text, files and code submitted through conversation, while a packaged snapshot of a repository and its history is not something a user submits through conversation. The policy's permissions table covers network and storage access and describes no repository snapshotting; the one data control it documents is the Optimization Program, off by default, which governs whether content is used for training rather than whether content is transmitted.
Grok Build was uploading entire Git repositories to xAI's servers, against marketing that said nothing from a codebase was transmitted during a session, and the privacy toggle meant to stop it did nothing. Chinese developers made that comparison themselves within hours of Z. ai's statement. The response is the part worth borrowing: Elon Musk confirmed the uploads, xAI deleted prior user data, documented a zero retention policy and added a privacy endpoint, and a retest on the same client then observed the uploads switched off. That is the step that turns a statement into a fact, and it is the step Z. ai has not yet offered. Z. ai has built its reputation on giving its models away and is approaching $1bn in annual sales while releasing its best models free, which means the paid product is the software around them. The weights are inspectable; the client reading the disk was not. Founder Tang Jie has argued that safety comes from broad participation and oversight rather than from technical barriers, an argument that did not reach the thing installed on developers' machines.
A software engineer at a leading Chinese robotics company, who asked not to be named because they were not authorised to speak publicly, told the Post their employer had banned Z. ai's tools internally over security concerns. A Shanghai developer who goes by Tuxi said the damage would fall on community trust rather than on the models, since GLM runs through other coding tools, including OpenAI's Codex, so users can drop the client without dropping the model. For a small team the practical question is which component is allowed to touch the disk and where it sends what it reads; for a larger company it is whether the vendor's documentation names that component at all. Z. ai has promised to release ZCode's codebase and invite third-party assessors, and the marker to watch is whether the uploader is inside that release. Somebody outside the company confirming on the same client that the uploads have stopped would settle more than any statement, and the privacy policy still describes files submitted through conversation and has not been updated since Friday.
