A developer reverse-engineered Z.ai's ZCode coding assistant and found it silently packaging entire private codebases, including full Git history, and shipping them to Alibaba Cloud in the background.
On September 18, an independent developer who goes by Ferstar noticed abnormal disk activity on a machine running ZCode, the coding assistant built by the Beijing AI company Z.ai (also known as Zhipu AI, the maker of the GLM model family). Digging into the tool's behavior, Ferstar found that ZCode had compressed an entire commercial workspace, 345.5MB across 42,411 files, into an encrypted archive and was trying to push it to Alibaba Cloud object storage. One archive alone hit 313MB. ZCode had already attempted the upload 564 times.
A feature nobody could switch off #
The culprit was a background feature called Codebase Indexing, which builds a cloud knowledge base Z.ai calls RepoWiki. It was switched on by default. According to a report from Tom's Hardware, there was no visible setting anywhere in the app to turn it off. The payload was mostly Git: 86.6% of it, in fact, meaning reflogs, commit history and local configuration files travelled along with the code itself. Reporting from InfoWorld found the archives also included LFS asset caches and global app configs. All of it was encrypted, so that only Z.ai could decrypt it on the other end.
Ferstar posted the findings publicly, and they spread fast among developers already wary of piping proprietary code through Chinese AI tools. Z.ai apologized within days. The company disabled the repository upload mechanism, deleted the associated Alibaba Cloud storage bucket, and said, according to InfoWorld, that the data "has never been used for model training." It shipped ZCode version 3.14.0, which strips out the Repo Wiki feature and the workflow that generated and uploaded local repository snapshots.
An apology, and its limits #
Z.ai didn't stop there. On September 21, it open-sourced ZCode's client-side code under an Apache-2.0 license, covering the Electron desktop app, the browser interface, the terminal agent, backend services and the agent runtime. That's a real gesture. But the repository launched with only two commits visible, no development history, and no SECURITY.md file or published security advisory, according to Runtime Wire. An open-sourced snapshot can't tell you what happened on the server side before it was cut, and it can't verify who held the encryption keys to the data that already made it to Alibaba's servers.
Z.ai's New GLM-5.3-Flash Model Runs 3.3 Times Faster on a Single Workstation Z.ai open-sourced GLM-5.3-Flash, a 320-billion-parameter MoE model that combines sparse and linear attention for a 3.3x inference speedup. It ships MIT-licensed with a 1M-token context window and can run locally on a single workstation with 102GB to 128GB of RAM, undercutting closed US labs on cost. - GLM-5.3-Flash model speed improvements for workstations - mixture of experts model runs faster than predecessor
Z.ai also commissioned outside reviews. The China Academy of Information and Communications Technology and the cybersecurity firm NSFOCUS both examined the Alibaba Cloud bucket in question. NSFOCUS confirmed the bucket and its data objects had been deleted, and the other assessment found the storage in what's described as a zero-data state. That's a reasonable amount of cleanup for a company that got caught. It's also exactly the kind of after-the-fact reassurance you'd expect whether or not anything was actually done with the data while it sat there.
The DeepSeek problem, again #
This isn't the first time a Chinese AI vendor has run into this exact question. DeepSeek spent much of last year fielding the same scrutiny over where user data actually goes and who can see it, and it never fully shook the doubt. Z.ai's episode gives that doubt something concrete to point to: a reverse-engineered upload pipeline, a specific archive size, a specific number of failed attempts. Cris Thomas, a security advocate quoted in InfoWorld's reporting, put the standard plainly: "Giving an AI access to proprietary source code should require clear disclosure about what leaves the machine, where it goes, how long it's retained and who can access it." ZCode didn't disclose any of that. It just did it.
For founders and engineering teams evaluating cheaper or faster coding assistants out of China, that's the real takeaway. The "just as good and free" pitch behind models like GLM and DeepSeek has always rested on trusting a vendor you can't audit in real time. Ferstar's disk-usage check is the kind of due diligence most teams never run on the tools they install. Maybe they should start. Also read: Oracle and Meta Are Selling AI Data Center Debt to Investors Hungry for Yield • Bernie Sanders Proposes 20-Year Prison Terms to Ban Superintelligent AI • The US Pitched China an AI Red Phone Modeled on the Cold War Hotline
This article is posted in AI News, check it out for more related stories.
Join the discussion #
Open in the community → Almost there. Sign in and your reply posts straight away.
Z.AI Reveals It Secretly Built Ox Alpha, the Model That Beat DeepSeek Z.AI has confirmed it is the developer behind Ox Alpha, the anonymous model that surged past DeepSeek on OpenRouter's leaderboard and became the marketplace's biggest launch to date. The company released the open weights, known informally as GLM-5.3 Flash, on Wednesday night, capping a week of stealth-mode speculation that included a shoutout from... - how to beat DeepSeek with reasoning model performance - Z.AI Ox Alpha model outperforms DeepSeek on leaderboard