Coding assistant silently encrypts and attempts to upload 42,411-file workspace to cloud storage without consent, raising serious doubts about AI agents
After discovering that AI agent could silently package an entire local workspace and attempt to upload it to Alibaba Cloud without clear user consent, Z.AI has open-sourced its coding assistant under the Apache 2.0 license.
The firm has apologized, saying it has removed the feature responsible, and has invited external review of the newly released code, according to Runtime Wire.
The issue had surfaced after an independent developer using the name ferstar examined ZCode while clearing disk space. He found a 313MB encrypted archive representing a commercial workspace containing 42,411 files, along with metadata recording 564 unsuccessful upload attempts.
The collected material reportedly included extensive Git data: the `.git` directory made up 86.6% of the archive, while the Git LFS cache alone accounted for 196.1MB.
According to the reverse-engineering findings, ZCode had obtained upload credentials and an RSA public key from Z.AI’s servers, then encrypted the archive with AES-256-CTR, and then tried to send it to Alibaba Cloud Object Storage.
Because Z.AI controlled the corresponding private key, the user could not decrypt the locally stored archive, raising concerns about what information the company could access if an upload succeeded, according to an AI Weekly report.
What caused the chaos
Z.AI attributed the conduct to a Codebase Indexing function that was enabled by default soon after launch. The feature could create full repository snapshots for a cloud-based Repo Wiki capability.
The firm that in ZCode 3.14.0 it has eliminated Repo Wiki and disconnected the local snapshot-creation and upload paths. It has also said it will establish a vulnerability-reporting program with rewards based on severity and plans to add a no-data-retention option for normal model calls on its platform.
Z.AI has also cited audits by the China Academy of Information and Communications Technology and NSFOCUS, which it says found that the Alibaba Cloud storage bucket contained no remaining data and that relevant stored objects had been permanently erased.
Still, independent observers cannot confirm whether any successfully uploaded files had been previously accessed or used for model training, since Z.AI held the decryption keys.
The dispute has also drawn legal pressure. According to BigGo Finance, Taiyuan Chengming Technology has demanded a written response by 10 October 2026, including a complete account of data processing, deletion evidence, access logs, information on possible third-party sharing or model-training use, and clarification of whether data crossed borders.
