ZCode, the Electron based AI coding app from Beijing's Z.ai, has been packaging users' entire git history, including deleted commit objects and reflogs, and sending it to Alibaba Cloud storage only Z.ai holds the key to. Developer ferstar published the reverse-engineering write-up on September 18, 2026. Z.ai apologized the same day and said it will open-source ZCode.

  • Whenever a signed-in user has ZCode open, the app packages the whole workspace, including .git commit objects, reflogs, the Git LFS cache and app configs, and uploads it to Aliyun OSS.
  • One captured snapshot totaled 313 MB across 42,411 files, and the .git directory alone accounted for 86.6 percent of that payload.
  • The upload is encrypted with AES-256-CTR under an RSA-OAEP wrapped key only Z.ai's servers can decrypt, so a user cannot read or verify their own snapshot.
  • The "Optimize Experience" and "Repo Snapshot Indexing" toggles never controlled the capture pipeline; they only governed server-side indexing and training permission.
How ZCode's snapshot upload pipeline moves your git history to Aliyun OSS The local workspace, git history and LFS cache are encrypted with AES-256-CTR under an RSA public key issued by the zcode.z.ai coordinator, then POSTed to Aliyun OSS. The private key never leaves the cloud. The privacy toggles sit outside this pipeline entirely. YOUR LAPTOP Workspace files .git history commits, reflogs LFS cache + configs Encrypt locally AES-256-CTR zcode.z.ai coordinator issues RSA public key POST to Aliyun OSS encrypted form upload Private key: cloud only "Optimize Experience" "Repo Snapshot Indexing" Toggles change indexing and training only. They never touch the capture pipeline. genztech.blog
Fig 1 Workspace, git history and LFS cache get encrypted with AES-256-CTR under a key from the zcode.z.ai coordinator, then POSTed to Aliyun OSS. The private key stays in Z.ai's cloud; the UI toggles never sit on this path.

How did ZCode secretly upload your git history?

The capture pipeline is built into ZCode from the moment you log in. It instantiates unconditionally at startup, fires again before every prompt and once more on task completion, staging each snapshot locally in ~/.zcode/v2/checkpoints/ before it leaves the machine. The app then talks to a coordinator at zcode.z.ai, which hands out the upload credentials and the encryption key. ferstar traced the endpoint to a config key, VITE_ZCODE_ENDPOINT_ORIGIN, inside the client's app.asar bundle. Each snapshot is encrypted with AES-256-CTR, wrapped under RSA-OAEP with a public key the server issues per session. Only Z.ai's infrastructure holds the private key, so the uploaded user cannot open their own archive. The affected build is ZCode Desktop v3.7.7, build 81fa9054, released August 14, 2026; logs show 564 failed upload attempts for a single snapshot and up to 62 capture events in one session.

RelatedOpenAI Puts $1B Behind Daybreak to Defend Water, Grids, Banks

What did the reverse-engineering actually find?

ferstar's method: read local logs for the upload URLs, unpack app.asar to trace capture through encryption to upload, then confirm the transfers were live over the socket connections rather than trusting the code alone. One example snapshot ran to 313 MB before encryption across 42,411 files, and the payload breaks down cleanly: 56.8 percent Git LFS cache, 29.6 percent commit-history objects, just 13.4 percent source code and docs. Roughly 345 MB of workspace data gets swept up per capture; the files visible in your editor are the minority of what goes out. The .git directory, history you may have deliberately deleted, made up 86.6 percent of one full snapshot.

What was actually inside a ZCode snapshot Payload composition of one captured ZCode snapshot: 56.8 percent Git LFS cache, 29.6 percent commit-history objects, 13.4 percent source and docs. ONE SNAPSHOT · 313 MB · 42,411 FILES 56.8% 29.6% 13.4% Git LFS cache Commit-history objects Source & docs 86.6% of the snapshot is .git, not the code you were writing genztech.blog
Fig 2 · benchmark Payload composition of one captured ZCode snapshot: 56.8% Git LFS cache, 29.6% commit-history objects, 13.4% source and docs. The .git-adjacent share alone is 86.6% of the total.

That is why this is not just "an app phones home." A working-tree diff never shows a key rotated out of an old config, a feature name sitting in a stale branch, or a hostname written into .git/config. Those live only in the object store, which is exactly what left the laptop.

From launch to apology: what Z.ai says now

Z.ai moved fast once the write-up went public. Within hours, a staff member posting as @maxforai on X apologized to affected users in Chinese, said the issue is patched, and said data collected for wiki generation was destroyed immediately after processing, never stored permanently. Z.ai attributed the transfers to a default indexing setting, gave every ZCode user a one-time reset of their weekly usage limits, and said it will open-source ZCode "in the near future," no date attached, and invite third-party assessors to audit the system. A GitHub project called zcode-upload-forensics, built by developer Zuixi, appeared the same day, checking whether your ZCode client uploaded your workspaces and producing a confidence-rated verdict with an HTML evidence report. The story climbed to the front page of Hacker News, drawing roughly 200 points.

RelatedVaultis Is Now on iPhone and iPad: One $4.99 Purchase Covers Every Apple Device

  1. 2026-08-14ZCode Desktop v3.7.7 ships. Build 81fa9054, the version ferstar's analysis targets.
  2. 2026-09-18ferstar publishes the reverse-engineering write-up. Also posts a public question to @Zai_org on X.
  3. 2026-09-18Z.ai responds and says the bug is patched. Apology, weekly-limit reset, open-source pledge, all same day.
  4. TBDOpen-source release and third-party audit. Z.ai has committed to both with no date attached yet.

What should you do right now?

  • Sign out of ZCode or uninstall it until the open-source build ships and can be checked.
  • Look inside ~/.zcode/v2/checkpoints/ and your local logs for evidence of prior uploads.
  • Rotate any secret that ever lived in the git history of a repo opened in ZCode, not just the current working tree.
  • Block zcode.z.ai and Aliyun OSS at the firewall if your organization has an egress policy.
  • Treat any AI coding tool that indexes a repository as having the whole .git directory, not just the editor view.
  • Compare a vendor's privacy-toggle claims against actual network traffic, since ZCode's toggles did not do what their labels implied.

What it means for the market

Z.ai and parent Zhipu AI are privately held, so there is no ticker to move directly. Enterprise buyers evaluating AI coding tools now have a case study for why "where does our code go" belongs in procurement, right as Zhipu pushes its GLM coding models against Claude Code and Codex; the credibility cost sits on the vendor side of that race. Alibaba Cloud (BABA) is the named storage provider, and while nothing here implicates its own security, being the default destination for an uninvited snapshot pipeline is not an association any cloud vendor wants. The signal for investors is that AI-IDE vendors now face the key-custody scrutiny cloud-storage vendors already do.

Our take

The damaging detail is not the upload, it is the key custody. A snapshot feature only the vendor can decrypt is not a backup, it is a one-way transfer dressed up as a product benefit, and that design turned a workspace feature into a black box nobody could inspect. Just as telling: the toggles labeled "Optimize Experience" and "Repo Snapshot Indexing" did nothing to stop the capture. That is the real trust breach. Open-sourcing the client is the right move, but it cannot answer what matters, which lives on the server: what got uploaded before the patch, who can see it, and whether defaults change again quietly.

What to watch
  • Does the release cover the server side? A client-only release says nothing about the coordinator and storage backend.
  • Does the audit produce a public report? An invitation to audit is not the same as a published finding.
  • Do affected users get a real accounting? Watch for whether Z.ai discloses what was uploaded, and when.
  • Does scrutiny spread to rival AI IDEs? ZCode is not the only tool indexing a full repository.
Primary sources

Original analysis by GenZTech. Primary source: ferstar.