The Apache-2.0 release exposes ZCode's desktop, web and CLI code, though its new GitHub repository launched without a security policy.
By [Ryan Merket](https://runtimewire.com/author/ryan-merket)
· Published
Primary source: [ZCode on X](https://x.com/zcode_ai/status/2101844704933621971)
Why it matters #
Open source lets developers inspect ZCode's client, but it cannot verify server-side retention, key custody or the scope of Z.ai's claimed remediation.
Z.ai open-sourced ZCode on September 21st after saying it had remediated security problems reported by users, a response to evidence that the AI coding agent packaged entire workspaces and sent encrypted snapshots to cloud storage.
ZCode said on X that it had completed the necessary remediation and apologized to users. The newly public repository carries an Apache-2.0 license and includes ZCode's Electron desktop application, browser interface, terminal agent, backend services, shared UI and agent runtime. The repository showed only two commits on launch day, indicating that Z.ai published a consolidated code drop rather than the development history behind the product.
The release follows a September 18th reverse-engineering report by a developer using the name ferstar. In one examined installation, ZCode created a 313MB encrypted archive representing 42,411 files from a 345.5MB commercial workspace. The .git directory accounted for 86.6% of the payload, including Git LFS data, commit objects and reflogs.
Ferstar traced the client requesting upload credentials from Z.ai's servers, receiving an RSA public key and credentials for Alibaba Cloud's object storage, and encrypting the archive with AES-256-CTR before attempting the upload. Z.ai controlled the corresponding private key, according to the analysis, leaving the user unable to decrypt the archive stored on the user's own machine. Local metadata recorded 564 failed upload attempts for one snapshot.
Two settings that appeared relevant did not stop the pipeline in the analyzed build. "Optimize Experience" governed permission to use content for training, while "Repo Snapshot Indexing" controlled server-side indexing after a snapshot had been uploaded. Ferstar found that ZCode still packaged and attempted to upload workspaces when those controls were disabled. Separate reports filed in Z.ai's public feedback repository described similar behavior in ZCode 3.12.3, including snapshots created while repository indexing was set to false.
Z.ai puts the runtime under inspection
Z.ai CEO Zhang Peng and co-founder Tang Jie have built the business around research that emerged from Tsinghua University's Knowledge Engineering Group. Tang, a Tsinghua computer science professor, previously led work on the Wu Dao model and created Zhipu AI with his team to commercialize its research. ZCode extends that model strategy into the developer's working environment, where the surrounding runtime determines which files an agent reads, stores and sends over the network.
Publishing the runtime gives developers a way to inspect those decisions directly. ZCode's repository includes the desktop host, web server, provider integrations, remote-workspace components and terminal agent rather than a thin interface around an unavailable binary. Its README also supplies local build instructions for the desktop, browser and command-line distributions.
The accompanying project notice is unusually explicit about the access an agent runtime can obtain. Z.ai says the shared execution adapter has no default operating-system sandbox, enabled plugins can introduce hooks and external processes, and remote environments may receive prompts, files, tool results and credentials. It also says model input and output logs may contain prompts, code, context and tool parameters, while some credentials are stored in encrypted local files rather than an operating-system keychain.
Those disclosures give users a clearer map of ZCode's current trust boundaries. They do not independently establish what happened to snapshots accepted by Z.ai's infrastructure before remediation. Client source can show whether the application still requests upload credentials or packages repository history. It cannot prove server-side deletion, retention or access controls. ZCode's own notice says the internal processing performed after requests reach its gateway is outside the scope verified by the client repository.
The GitHub repository also launched without a SECURITY.md file or published security advisories. GitHub's Security tab consequently offered no standard private reporting instructions on September 21st, despite ZCode's statement that community scrutiny was part of the reason for releasing the code.
Open sourcing shifts the next phase of the incident from reverse engineering a packaged Electron application to comparing public code with the binaries Z.ai distributes. Developers can now test whether released builds match the repository, whether workspace capture remains in any execution path, and which network requests occur before and after a prompt. Z.ai's remediation claim will stand on those reproducible checks, along with a verifiable account of how previously uploaded repositories were handled.