ZCode’s Silent Workspace Uploads: What Ferstar Found and What Z.AI Fixed

On September 18, 2026, researcher ferstar documented ZCode preparing an encrypted snapshot of his local workspace for upload to Alibaba Cloud. The finding raised a question beyond whether a coding assistant sends code to a server: why was it packaging an entire workspace, including project history, without explicit user consent?41032

What ZCode packaged—and what the upload logs show

In ferstar’s case, ZCode assembled 42,411 files into a 313 MB archive and logged 564 attempts to send it to Alibaba Cloud object storage. Reporting on his analysis says all 564 attempts failed on his machine. Those figures describe one observed case; they do not establish how many other users’ uploads succeeded.10

The snapshot extended beyond current source files to Git history, including material such as reflogs and Git LFS cache. Reports also identified the risk that full-workspace packaging could capture sensitive configuration or credentials alongside code.414

How the archive was encrypted

According to ferstar’s reported technical analysis, ZCode encrypted the archive contents with AES-256-CTR, then wrapped the content-encryption key with RSA-OAEP-SHA256 using a public key supplied by the server. The client also received credentials for the Alibaba Cloud object-storage upload.10 The corresponding private key was held on Z.AI’s backend, so users could not decrypt an uploaded archive themselves or independently inspect its contents. Nor could they personally verify Z.AI’s account of what happened to a copy already uploaded.17

Z.AI’s explanation and response

Z.AI attributed the behavior to a default-enabled Codebase Indexing feature and said it had patched the vulnerability. Its explanation linked repository uploads to generating a Repo Wiki page and said the data was destroyed after that page was generated. The company apologized, then published ZCode’s source code under the Apache 2.0 license.17222

Ferstar’s examination of version 3.14.0 found that the repoSnapshot upload pipeline had been removed and that the cloud-credential endpoint returned a 404 response. Reported security assessments by the China Academy of Information and Communications Technology and NSFOCUS found the relevant Alibaba Cloud bucket empty or deleted and found no remaining snapshot-triggering path in the updated client.237 Open-sourcing made the released code available for scrutiny, although ferstar noted that the published repository had only two commits rather than its earlier development history.9

Z.AI also said it would establish an ongoing vulnerability-reporting process. Separately, reporting described plans for users to request non-retention of data on its MaaS platform; the reported policy has exceptions, including some API paths and information kept for legal, security or abuse-prevention reasons.1320

What the response does not prove

Z.AI said the code data was not retained and had never been used for model training. The reported bucket assessments support a narrower conclusion about the storage they checked: they do not, on their own, independently verify the company’s statement about historical model-training use.89

The dispute also drew a reported legal letter from an enterprise customer seeking answers about the handling of uploaded data. The available reporting does not establish the outcome of that demand or provide independent proof of deletion for each affected user.1821 Z.AI’s Hong Kong-listed shares fell by more than 5% at one point during September 21 trading, according to contemporaneous market reports; that intraday move should not be confused with a closing-price change.3033

For developers assessing the incident, the distinction is between a verified client-side fix and reported checks of a particular cloud bucket on one hand, and broader claims about every past copy and its use on the other. The first has supporting evidence; the second remains dependent on Z.AI’s account and the scope of the assessments disclosed.7823