Z.ai's encrypted workspace upload raises security concerns
Developer discovers unauthorized Git repository uploads to Alibaba Cloud by Z.ai's coding assistant
1Unauthorized Git uploads discovered
A developer found ZCode had created a 313MB encrypted archive of their commercial project's Git history, attempting to upload it to Alibaba Cloud 564 times. Smaller files had already been transmitted successfully. The uploads occurred without user consent through a default-enabled feature in Z.ai's coding assistant. This included complete repository histories with revoked credentials and internal messages never meant for external viewing.
2Encryption prevents user verification
The uploaded archives use encryption where only Z.ai holds the private key, making independent verification impossible. While Z.ai claims data is deleted after processing, developers can't confirm this destruction. The privacy policy effective since June 15 mentions collecting conversational data but doesn't address repository snapshots. This creates a trust gap regarding what data actually gets transmitted versus what users knowingly provide.
3Feature design versus security flaw
Z.ai framed the uploads as intentional for cloud-based Wiki generation and session recovery features, not as a bug. This distinction shifts responsibility from engineering to product decisions about default settings. The feature was enabled by default post-launch, catching developers unaware. Unlike typical data collection that users might expect, repository snapshots capture historical project artifacts developers wouldn't anticipate sharing.
4Industry-wide coding agent vulnerability
The incident highlights systemic security challenges with AI coding tools that access local workspaces. Similar issues emerged with xAI's Grok Build, which uploaded entire repositories despite marketing claims. These tools operate with broad system access but lack corresponding audit mechanisms. Researchers have demonstrated how simple prompts can hijack coding agents like Claude Code, exposing deeper trust-calibration problems in developer tools.
5Corporate security responses
Some Chinese tech companies have already banned Z.ai tools internally due to security concerns. Unlike xAI which documented a zero-retention policy and added privacy controls after its incident, Z.ai hasn't yet provided external verification of upload cessation. Developers note the trust damage primarily affects ZCode's client software rather than Z.ai's open-weight models, as alternatives exist for accessing the same AI capabilities.
6Open-source promises pending
Z.ai pledged to open-source ZCode's codebase and involve third-party auditors, but questions remain about whether the workspace uploader component will be included. The company built its reputation on model transparency while keeping client software proprietary. This incident exposes that dichotomy - while AI weights are inspectable, the disk-reading client software wasn't subject to equal scrutiny.
7Verification gap in privacy claims
Current technical implementation means only Z.ai can confirm whether uploaded data was actually deleted, creating an accountability loophole. Developers emphasize the need for reproducible tests showing uploads have stopped on the same clients where they were observed. Without this technical verification, policy statements remain unproven claims. The privacy policy still doesn't address repository data collection as of last update.
8Broader implications for AI tools
This case illustrates how AI-assisted development tools introduce novel data governance challenges. Features designed for usability (like automatic cloud backups) can conflict with developer expectations about local workspace boundaries. As coding agents gain deeper system integration, the industry needs clearer standards about data collection scope, retention policies, and verifiable deletion mechanisms for sensitive development artifacts.
Original article: The Next Web — Z.ai's encrypted workspace upload raises security concerns