AI
Your Coding Assistant Saw Your Whole Repo, and the Developer Internet Caught It
On September 18, a developer going by ferstar published a reverse engineering walkthrough that lit up the developer internet in two languages within hours. The target was ZCode, the AI coding desktop app from Z.ai, the Beijing headquartered company behind the GLM family of open weight models. The finding was stark. Whenever a user was logged in, ZCode silently packaged the entire workspace, complete git history, LFS asset cache, reflogs, and global app configs, encrypted the bundle, and uploaded it to Aliyun OSS, Alibaba Cloud's object storage. The researcher's own capture was a 313 megabyte encrypted archive built from a 345 megabyte commercial workspace, 42,411 files, with 564 upload attempts logged during the investigation.
The mechanism was a default enabled Repo Wiki feature inside the codebase indexing system, built to support session checkpoints, version rollbacks, and wiki generation. According to Reuters reporting, users found the feature always on, and the privacy policy left the behavior undisclosed. The archives were encrypted with keys held on Z.ai's servers, which meant users could see that data had left their machines while the exact contents stayed visible only to Z.ai. One company, Chengming Technology, said six coding workspaces had been uploaded, including source code, database passwords, and employee personal information, though it later retracted the complaint citing wrong evidence.
The trust angle is the part that stung. Plenty of developers adopted ZCode because GLM's weights are open, and the thread reaction showed the confusion was live. Several commenters assumed ZCode was open source because GLM is. The reality splits the two. The weights are open, and the harness is closed, and it is Z.ai's own harness for its own models, pitched as in house integration beyond what any outside editor offers. Open weights earned the community's confidence, and then the closed wrapper spent it, which is why ferstar's post passed 276,000 views and a Chinese language alert thread drew another 63,800.
Credit where it is due. Z.ai's response was fast and unusually complete. The company apologized on Friday, said the data was used only to generate wiki content and then destroyed, disabled the whole mechanism in version 3.14.0 on September 19, and added zero data retention options. Independent audits by the China Academy of Information and Communications Technology and NSFOCUS confirmed the relevant cloud bucket reached a zero data state and the fixed client arrived with those code paths removed. Then came the big move, a commitment to fully open source the client, backend, UI, and agent runtime so the community can inspect the code going forward, plus a standing vulnerability reporting program with severity based rewards and a week of quota resets for affected users.
Some developers noted the open sourced package arrived as a single large code dump, with earlier builds unavailable for comparison, so verification has limits, and the episode leaves a real lesson about the new stack. AI coding assistants are privileged applications with the keys to the repo, and they deserve the same scrutiny as any software that touches secrets, with data flow audits, default setting reviews, and network monitoring as standard practice.
For developers, the practical outcome is genuinely better than the starting point. A popular coding agent is now open for inspection, two independent audits confirmed the data is gone, and the whole industry just watched what happens when defaults betray trust. Treat every AI harness as privileged software, read the defaults before you log in, and remember the line the community drew this week. Open weights are a promise, and the runtime around them has to earn it separately.
Quick answers
What is this story about?
On September 18, a developer going by ferstar published a reverse engineering walkthrough that lit up the developer internet in two languages within hours. The target was ZCode, the AI coding desktop app from Z.ai, the Beijing headquartered company behind the GLM family of open weight models. The finding was stark. Whenever a user was logged in, ZCode silently packaged the entire workspace, complete git history, LFS asset cache, reflogs, and global app configs, encrypted the bundle, and uploaded it to Aliyun OSS, Alibaba Cloud's object storage. The researcher's own capture was a 313 megabyte encrypted archive built from a 345 megabyte commercial workspace, 42,411 files, with 564 upload attempts logged during the investigation.
Why does this story matter?
For developers, the practical outcome is genuinely better than the starting point. A popular coding agent is now open for inspection, two independent audits confirmed the data is gone, and the whole industry just watched what happens when defaults betray trust. Treat every AI harness as privileged software, read the defaults before you log in, and remember the line the community drew this week. Open weights are a promise, and the runtime around them has to earn it separately.
Sources
- DevOps.com on the ZCode upload incident
- AInvest on Z.ai response and open source commitment
- Arc Codex, ferstar reverse engineering walkthrough
New to crypto? Read the crypto glossary, browse frequent questions, read our story, or explore the story archive.