Z.ai Faces Backlash After ZCode Client Uploads Encrypted Git Repositories by Default

Chinese artificial intelligence startup Z.ai is facing mounting security concerns after developers discovered its ZCode desktop client silently packaging and uploading full local code repositories to cloud storage by default. The issue was first highlighted by a developer writing as Ferstar, who found a 313-megabyte encrypted archive in ZCode's local directory that had failed 564 times to upload to Alibaba Cloud storage after a smaller archive had already transmitted, according to reporting by the South China Morning Post.

The archive contained a full snapshot of an active commercial software project, including its complete Git version history. Unlike a simple file snapshot, a repository's Git directory retains the entirety of a project's revision log, which often houses historical commit messages, internal system hostnames, abandoned development branches, and previously revoked credentials that are no longer present in current files. Ferstar noted that the archive was encrypted using a private key held exclusively on Z.ai's back end, preventing users from inspecting the payload locally, and that the ZCode client offered no setting to disable the background transmission. A second blogger, Feng Ruohang, reported observing at least three separate files uploaded from his machine.

Z.ai issued an apology on its official Feishu community channel, later reposted to the forum V2EX, stating that the incident stemmed from ZCode's repository indexing feature. The functionality powers session checkpoint recovery, code rollbacks, and automated Repo Wiki generation. Z.ai acknowledged that generating a Repo Wiki in the cloud triggered a repository upload and that the mechanism was enabled by default following the tool's release. The company stated that uploaded data is purged immediately after Wiki generation finishes and is not retained, though developers pointed out that because the encryption keys reside on Z.ai's servers, independent verification of that deletion is impossible.

An examination of ZCode's privacy policy by The Next Web (https://thenextweb.com/news/zai-zcode-encrypted-upload-only-zai-can-verify) revealed that the terms, in effect since June 15 without amendment, state that the service collects text, files, and code submitted through user conversation. The policy's permissions table covers network and storage access but omits any mention of automated repository snapshotting. Additionally, the only documented data control—the Optimization Program toggle, which is disabled by default—governs whether user submissions are used for AI model training rather than controlling whether code is transmitted to remote servers.

The telemetry discovery has prompted comparisons to recent issues with xAI's Grok Build, which was found uploading Git repositories despite marketing assurances that code stayed local. In that case, xAI confirmed the uploads, purged user data, documented a zero-retention policy, and introduced a privacy toggle verified by third-party testing. Z.ai has pledged to open-source ZCode's codebase and bring in external auditors, but has not yet offered an independent verification of the client-side fix.

The fallout is already impacting enterprise adoption in China, where an engineer at a robotics firm told the South China Morning Post that their company instituted an internal ban on Z.ai tools. Shanghai developer Tuxi noted that because Z.ai's underlying GLM models are accessible through third-party environments such as OpenAI's Codex ecosystem, developers can abandon the ZCode client without ditching the underlying models. The controversy arrives as Z.ai approaches $1 billion in annual sales, built on a model where core model weights are released freely while proprietary client software and enterprise services generate commercial revenue.