Not officially. The most visible reply came from an account linked to the ZCode team saying 'hey I am sorry to let you find it', which the coverage describes as confirming the mechanism rather than disputing it. No statement from Z.ai leadership and no fix have been published alongside the reports.

Can I decrypt my own uploaded snapshot?

No. ZCode encrypts the archive with a symmetric key that is then wrapped using an RSA-OAEP public key supplied by Z.ai's server, and the matching private key lives only in Z.ai's cloud. That means the user who produced the data cannot open the copy that was uploaded from their own machine.

How do I stop the uploads?

The investigation's workaround is to set a filesystem immutability flag on ZCode's checkpoint directory so the client cannot write the snapshot it would otherwise upload. The trade-off is that ZCode's rollback feature stops working, since the same checkpoint archive is what rollback restores from.

When does ZCode send data?

ZCode builds and uploads the snapshot before every prompt and again when a task finishes, for as long as the user is logged in, according to the ferstar investigation. It is not a one-time onboarding upload, so a long coding session repeats the transfer many times over.

ferstar · 2026-09-18 · major

ZCode uploads your whole repo — .git history included, keys held by Z.ai

ZCode, Z.ai's desktop coding agent, packages the whole workspace including the full .git directory, encrypts it and uploads it to Aliyun OSS, a developer writing as ferstar found. The private key stays on Z.ai's servers.

Article card for the report that ZCode silently uploads git history to the cloud — Tokenstead

A developer traced ZCode's checkpoint feature and found it shipping entire git histories to Alibaba Cloud.

Key specs

.git share of payload	86.6%

Quick facts

Product	ZCode, Z.ai's desktop coding agent
What is sent	Whole workspace snapshot
Biggest part	.git objects, LFS cache and reflogs
Destination	Aliyun OSS, callback to Z.ai
Encryption	AES-256-CTR, key wrapped with Z.ai's RSA key
Trigger	Before every prompt and on task completion
Sample size	313 MB sent from a 345 MB workspace

What is it?

Every prompt in ZCode triggers a full workspace snapshot, according to an investigation published by a developer writing as ferstar. The archive is not limited to the files you are editing: it contains the complete .git directory, the Git LFS asset cache, reflogs and ZCode's own global config. In one measured run, 313 MB left the machine from a 345 MB workspace, and .git alone accounted for 86.6% of it.

How does it work?

The snapshot powers ZCode's rollback feature. The client encrypts the archive locally with AES-256-CTR, then wraps that symmetric key with an RSA-OAEP public key handed out by Z.ai's server, and posts the result straight to Aliyun object storage with a callback to Z.ai's backend. Because the matching private key only exists in Z.ai's cloud, the user cannot decrypt their own archive. The post's workaround is to set a filesystem immutability flag on the checkpoint directory, which blocks the upload and also disables rollback.

Why does it matter?

Git history holds things the working tree does not: deleted API keys, unpushed branches, internal hostnames and every past revision of every file. Teams that cleared a leaked secret by rewriting history, or that work under contracts restricting where source code may travel, need to know a coding agent is copying all of it to a third-party bucket they cannot read back. Anyone running ZCode on a work repository should check their policy before the next prompt.

Who is it for?

developers and security teams running ZCode

Frequently asked questions

Has Z.ai responded?: Not officially. The most visible reply came from an account linked to the ZCode team saying 'hey I am sorry to let you find it', which the coverage describes as confirming the mechanism rather than disputing it. No statement from Z.ai leadership and no fix have been published alongside the reports.
Can I decrypt my own uploaded snapshot?: No. ZCode encrypts the archive with a symmetric key that is then wrapped using an RSA-OAEP public key supplied by Z.ai's server, and the matching private key lives only in Z.ai's cloud. That means the user who produced the data cannot open the copy that was uploaded from their own machine.
How do I stop the uploads?: The investigation's workaround is to set a filesystem immutability flag on ZCode's checkpoint directory so the client cannot write the snapshot it would otherwise upload. The trade-off is that ZCode's rollback feature stops working, since the same checkpoint archive is what rollback restores from.
When does ZCode send data?: ZCode builds and uploads the snapshot before every prompt and again when a task finishes, for as long as the user is logged in, according to the ferstar investigation. It is not a one-time onboarding upload, so a long coding session repeats the transfer many times over.