Credit: Zhipu A Chinese developer who writes as Ferstar looked inside ZCode’s local directory on Friday and found a 313MB encrypted archive waiting to be sent to Alibaba’s cloud storage. It had failed 564 times. A smaller file had already gone. Minxiao Chang and Wency Chen reported the account for the South China Morning Post.
The archive held a snapshot of a commercial project he was working on, including its Git history. He could not open his own file This is the detail that separates the incident from an ordinary privacy complaint. Ferstar said the archive could not be decrypted by him or by the ZCode client, because the private key sits on Z.ai’s back end. The upload was on by default and there was no button to turn it off, he said.
Another blogger, Feng Ruohang, wrote on Friday that he had seen at least three files uploaded. Alibaba, which owns the South China Morning Post, did not respond to the Post’s request for comment on Sunday. Git history is not the working directory The megabytes are the least interesting number here. A repository’s Git directory holds every change since the project began, which is a different category of thing from the files currently on disk.
Credentials that were committed and later revoked stay in the history. So do abandoned branches, internal hostnames and commit messages nobody expected an outsider to read. That is why coding agents are a harder security problem than chatbots. The gap between what these tools are trusted with and what they are audited for is already the industry’s standing weakness, and a researcher has hijacked Claude Code simply by asking it to summarise a web page. The company calls it a fix, and its statement describes a feature Z.ai apologised in its official Feishu community on Friday and said the problem was resolved. The statement, reposted in full on V2EX, traces it to ZCode’s code repository indexing feature, which supports session checkpoint recovery, version rollback and a Repo Wiki.
Generating a Wiki page in the cloud could trigger a repository upload, the statement said, and the feature was on by default in the period after launch. That is a description of something built rather than something broken. The distinction decides what users should ask next. A bug gets patched, while a default gets decided by somebody.
The destruction claim cannot be checked Z.ai said the uploaded data is destroyed immediately once the Wiki page has been generated and is not retained. Ferstar asked in a Saturday update how anyone is supposed to verify that. The question answers itself. Z.ai built the archive so that only Z.ai could read it, which means only Z.ai can report what became of it.
What the privacy policy actually says TNW read ZCode’s privacy policy, which took effect on 15 June and has not been amended since. It says the service collects text, files and code submitted through conversation. A packaged snapshot of a repository and its history is not something a user submits through conversation. The policy’s permissions table covers network and storage access, and describes no repository snapshotting.
The one data control the policy documents is the Optimization Program, which is off by default. It governs whether content is used for training, not whether content is transmitted. That is the gap this sits in. A developer who read the policy and left the training toggle alone had no reason to expect any of it.
This has happened before, and that fix was checkable Grok Build was uploading entire Git repositories to xAI’s servers, against marketing that said nothing from a codebase was transmitted during a session. The privacy toggle meant to stop it did nothing. Chinese developers made that comparison themselves within hours of Z.ai’s statement. The response is the part worth borrowing: Elon Musk confirmed the uploads, xAI deleted prior user data, documented a zero retention policy and added a privacy endpoint.
A retest on the same client then observed the uploads switched off. That is the step that turns a statement into a fact, and it is the step Z.ai has not yet offered. Open weights, closed client Z.ai has built its reputation on giving its models away. It is approaching $1bn in annual sales while releasing its best models free, which means the paid product is the software around them. That is the structure this exposes.
The weights are inspectable, and the client reading the disk was not. Founder Tang Jie has argued that safety comes from broad participation and oversight rather than from technical barriers. It is a good argument, and it did not reach the thing installed on developers’ machines. The cost is already landing A software engineer at a leading Chinese robotics company, who asked not to be named because they were not authorised to speak publicly, told the Post their employer had banned Z.ai’s tools internally over security concerns.
A Shanghai developer who goes by Tuxi said the damage would fall on community trust rather than on the models. GLM runs through other coding tools, including OpenAI’s Codex, so users can drop the client without dropping the model. What to watch Watch whether the open-sourcing covers the uploader. Z.ai has promised to release ZCode’s codebase and invite third-party assessors, and the question is whether the component that packaged the workspace is in it.
Watch for a retest. Somebody outside the company confirming on the same client that the uploads have stopped would settle more than any statement can. Watch the privacy policy. It still describes files submitted through conversation, and it has not been updated since Friday.
