"We sincerely thank the community developers who previously identified issues in ZCode. Going forward, we will establish an ongoing product security vulnerability reporting and response process," ZCode said in a public statement.
Ferstar's finding: repositories packaged, git-encrypted and shipped to Alibaba Cloud
Security researcher Ferstar discovered that ZCode, the code-generation component of Z.ai, was packaging entire user workspaces — including complete project histories — encrypting them with git-compatible tooling, and uploading the resulting archives to Alibaba Cloud. According to the report, the private key required to decrypt those uploads was held only on Z.ai’s servers, meaning affected users could not access or delete files the tool had pushed.
Ferstar also reported there was no user setting to disable this behavior and no disclosure of the practice in ZCode’s privacy policy. The researcher identified the Repository Index functionality as the core problem: when the Repo Wiki feature generated pages in the cloud, it triggered the uploading of files.
ZCode's apology, claimed fixes, and promises
ZCode released a statement apologizing for the "security issues" and asserted that the data it uploaded had never been used to train its models. The company said it would establish a product security vulnerability reporting and response process, offer rewards based on issue severity, and welcome continued community review. The statement was published on the company's channels — the report noted the company "Xeeted" the announcement.
ZCode said it had removed the Repo Wiki feature and tasked two outside bodies — the China Academy of Information and Communications Technology (CAICT) and Beijing security firm NSFOCUS — to probe the product following the implemented changes. The company claimed those outside assessments concluded that all previously uploaded data had been deleted, and ZCode pledged to release a full security assessment report "soon."
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildOpen sourcing ZCode and the community's pushback
As part of its response, ZCode open sourced the entire project on GitHub, stating the move would place the code "under community scrutiny and making ZCode more open and transparent." Ferstar confirmed the open-sourced repository showed no signs the Repo Wiki remained implemented.
However, Ferstar criticized ZCode for stripping commit records and removing the specific source code that had performed the uploads before the patch. That criticism highlights a lingering community concern: open-sourcing code after erasing historical commits removes evidence and hinders forensic review of how the uploads were implemented and when they were active.
Z.ai's market position and the wider context
The company behind ZCode, Z.ai (formerly known internationally as Zhipu), is described in the report as one of the most heavily backed LLM-focused firms in China. The report notes Z.ai is the first AI company in the post-Gen AI era to launch and subsequently IPO on the Hong Kong Stock Exchange, and that it spun out of Tsinghua University’s Knowledge Engineering Group research lab in 2019.
Z.ai has publicly claimed its model GLM-5.3 matches advanced equivalents from Anthropic and OpenAI at hunting for security vulnerabilities and has also asserted it developed the first advanced model entirely on Chinese (Huawei) hardware. The report further says Anthropic and OpenAI have expressed concern about model capabilities from Z.ai and Moonshot, and that the US government is reportedly mulling restricting access — a context that ties technical security questions to geopolitics and market access.
What this means for developers, security teams, and regulators
- Developers and open-source reviewers: Ferstar's confirmation that the open-sourced ZCode no longer contains Repo Wiki code is a step forward, but the removal of commit history raises forensic and trust questions. Developers should review the newly published repository and consider independent verification of claims that prior uploads were deleted.
- Security teams and cloud administrators: the incident underscores a practical risk — developer tooling that packages and uploads workspace contents to third-party cloud storage can place private keys and control out of users' hands. Teams should audit integrations that automatically create and move repository artifacts to cloud providers such as Alibaba Cloud and verify where decryption keys are held.
- Policymakers and procurement officials: ZCode's handling — rapid removal of a feature, external assessments, and an open-source release coupled with erased commit history — will likely factor into procurement decisions and regulatory scrutiny, especially given the report’s note of broader concern about model capabilities and potential access restrictions.
ZCode's public remediation — feature removal, third-party probes, deletion claims, and open sourcing — moves the episode from discovery into verification. The company has promised a full security assessment report and a bug-bounty-style response process; the community has delivered independent scrutiny but flagged the absence of original commit history. Whether those follow-up reports and the restored ability to audit ZCode’s past actions will satisfy developers and regulators remains the immediate test.
Original story: https://www.theregister.com/security/2026/09/22/zai-says-sorry-for-slurping-up-your-code-open-sources-zcode/5298300
