Z.ai Apologizes for ZCode Security Issues and Open-Sources the Tool
Z.ai has apologized for uploading local repositories without consent, open-sourced the tool ZCode, and commissioned two security assessments. The developer who found the problem confirms that the upload code has been removed, and the published repository carries only two commits with the development history erased.
September 22, 2026 - 5:10 pm
Credit: Mohammad Rahmani on Unsplash
In response to community reports of security issues with ZCode, Z.ai completed necessary remediation and sincerely apologizes to all users. Z.ai posted this on ZCode’s official account on Monday, simultaneously open-sourcing the coding tool's source code on GitHub. They have removed the Repo Wiki feature, disabled a workflow that generated and uploaded local repository snapshots, and shipped the fix in ZCode v3.14.0.
Two external bodies verified the results:
- The China Academy of Information and Communications Technology found the zcode-prod Alibaba Cloud storage bucket in a "zero-data state."
- Security firm NSFOCUS reported that the bucket and every object within it had been deleted. Z.ai states that the code never accessed their training data. They have promised to release a full assessment report.
TNW previously reported (see original text for quote) that only Z.ai could access the files, leaving them as the sole arbiter of whether they existed. The company has now provided more information, but the researcher who discovered the problem points out a gap in their explanation.
What Ferstar Actually Found
The developer known as ferstar (who broke this) published an analysis on September 18th. Within a local ZCode checkpoints directory, they found:
- A 313MB encrypted snapshot of a commercial project with 564 failed upload attempts recorded in its status log.
- The snapshot contained 42,411 files, predominantly Git directories (accounting for 86.6% of the archive).
- One smaller snapshot reached the server, containing 538 public files that compressed to about 15KB.
Two triggers captured the data:
- One before each user prompt.
- The other during a Repo Wiki update task.
ZCode encrypted file contents with AES-256-CTR and wrapped the symmetric key with RSA-OAEP-SHA256. The public key originated from Z.ai’s servers, keeping the private key secure on their end.
Two settings designed to prevent this capture proved ineffective. Both controlled downstream data handling rather than preventing ZCode from taking snapshots unconditionally.
Verification Problem Persists
Ferstar returned to the code on September 21st, after it became public. They confirmed the removal of the upload pipeline and that the checkpoint mechanism now only handles local Git operations with no cloud access. However, they also discovered:
- The published repository contains only two commits.
- The development history is gone, along with the code responsible for uploading.
- The tool can now be inspected, but what it previously did cannot be verified. This raises concerns similar to the original complaint, now presented as a deletion claim reliant on Z.ai’s own statement.
One of the Loudest Claims Withdrawn
(The text provided ends here with a sentence referencing "a Chinese firm called Chengmin" which seems incomplete or out of context.)