ZCode quietly uploaded whole repos and git history to Z.ai's cloud
Two stories about who can read the code you hand your agent — one from a developer who found the upload on his own disk, one from a government website that outsourced search to a model Washington has spent the month accusing.
Z.ai's coding agent ZCode was packing entire repositories — git history included — into an encrypted archive and uploading them to the company's cloud, and the only key that opens them is Z.ai's. The finding comes from developer ferstar, who traced a 313-megabyte archive sitting in a pending state on his own machine back through the logs and the app's packaged code. The encryption is textbook envelope encryption: the payload is locked with a symmetric key, and that key is wrapped with an RSA-OAEP public key the server hands over during upload-credential negotiation. The matching private key exists only in Z.ai's cloud. ferstar tried every private key on the system and failed — the ciphertext on a user's own disk cannot be opened by the user or by the ZCode client itself.
The packaging manifest is stored locally in plaintext, which is how the contents are known: a 42,411-file snapshot that was very nearly all of it .git. Nothing in the settings stops it. The capture sidecar is instantiated unconditionally at startup with no check against user preferences — the only requirement is a valid login token — and it fired 62 times in a single session, before every prompt and again on task completion. That pipeline never appears in the agent's own tool list, so no permission prompt ever surfaces it. Deleting the archive buys nothing: within half an hour ZCode had re-packed a fresh 313-megabyte file and the retry counter climbed again. The defense that holds is filesystem-level — make the checkpoints directory read-only and the packer has nowhere to write.
The context is what makes it bite. ZCode launched in July pitched as first-party integration and as the open-weights answer to closed-lab telemetry, Z.ai listed in Hong Kong in January, and a company executive answered a question about spyware by saying nothing beyond what is listed on the ZCode website would be implemented. Workspace snapshotting is not listed there, and the privacy policy covers only "text, files, and code submitted during conversations." The reaction was loud in both languages — ferstar's writeup passed 276,000 views in thirteen hours — and the most visible reply came from an account affiliated with the ZCode team: "hey I am sorry to let you find it." We have flagged the shape of this problem before — a repo you only opened can run code through your AI coding agent — but that one was a stranger's repo exploiting your tool. This is the tool itself, and open weights do not make a setup local when the harness around them phones home.
The Federal Register, the government's daily record of proposed rules, was offering visitors an AI search built on Alibaba's Qwen — and it was pulled on Wednesday around the same time screenshots of it started circulating. No one has said how long it had been live. The FBI declined to comment, and the National Archives and the White House did not respond to questions, which leaves the awkward part unaddressed: the same agency whose Qwen tools the FBI accused last week of "malicious" copying of Anthropic technology was serving a foreign model on a US government domain days before a Trump-Xi meeting.
The expert read is narrower than the outrage. The Federal Register's content is already public, so no sensitive data was in the model's working set, and Georgetown Law's Anupam Chander said the deployment posed no immediate cybersecurity risk — Senate Intelligence vice chairman Mark Warner's sharper framing was that the question is whether US data left the government's security boundary and got processed on Alibaba-controlled systems. That distinction matters because Qwen is open-weight: the model can be downloaded and run on your own infrastructure, which is precisely why cost-conscious teams pick it over closed APIs. Representative John Moolenaar, who chairs the House China Committee, called it "one of the most insane things I've ever seen" and said no federal entity should use a Chinese model. The Chinese embassy called the copying allegations unfounded.
What to watch: whether Z.ai ships a fix, a disclosure change or a straight denial, and whether any other US agency is running a Qwen-backed search that has not been screenshotted yet.
If the harness around an open-weight model phones home, is the model still open in any sense that matters to you? Tell us in the comments.
