The coding agent that uploaded your repo wasn't hijacked, it was the vendor's design. zcode,…
the coding agent that uploaded your repo wasn't hijacked, it was the vendor's design. zcode, zhipu's coding app, was found sept 18 silently encrypting the whole workspace plus full .git history — deleted keys, reflog, lfs — to aliyun oss, with the decryption key held only by z.ai.
zhipu apologized and promised to open-source the client, which is the only answer that rebuilds trust.
Context
An independent researcher's post, dated 17 to 18 September 2026 and updated later, says a logged-in ZCode client version 3.12.3 packaged the workspace including .git history, LFS cache, reflogs and app configs, encrypted it and uploaded it to Aliyun OSS, with an RSA public key served by the server and the private key staying server-side, in an archive of about 313 MB, and that disabling Optimize Experience and Repo Snapshot Indexing still packaged and attempted uploads. The Next Web of 20 September 2026 reports Z.ai apologised in its Feishu community on 18 September, traced the upload to a repository-indexing feature on by default, said it was fixed, and promised to open-source the client and invite third-party assessment. The Register of 22 September 2026 reports Z.ai then open-sourced the project and said two outside assessments found the uploaded data deleted.
The behavior is the researcher's own reverse engineering, which was not reproduced here, and Z.ai's own statement was read only through secondary relays. Z.ai's account does not contest that uploads occurred; the scope, the toggles and the deletion are disputed. That it was the vendor's design is the author's inference: Z.ai described an indexing feature on by default that may trigger upload, and intent is not established. That only Z.ai holds the key comes from the researcher and The Register, and the key architecture was not read first-party. The open-source promise was fulfilled on 21 September, after the note; the researcher criticised the published repository for a wiped commit history and no uploader code. Open-sourcing being the only answer that rebuilds trust is the author's opinion.
Watch next
- Z.ai's promised security assessment report and the pre-patch uploader code.
Sources
- ZCode silent workspace snapshot upload (ferstar)blog.ferstar.org
- Z.ai ZCode encrypted upload (The Next Web, 20 Sep 2026)thenextweb.com
- Z.ai says sorry and open-sources ZCode (The Register, 22 Sep 2026)theregister.com
Provenance
The note above is reproduced unedited from the original post, first published on Threads on 20 September 2026 at 02:19 IST. Sources are the papers and datasets the note draws on.
View the original post ↗Embed this note
More notes
The air is now being asked to keep its own ledger
the air is now being asked to keep its own ledger: ecmwf’s aifs compo becomes the first ai model to forecast atmospheric composition globally every three hours, cleanair simulates 365 days of pm2.5 over china in ten seconds, and a unified framework maps six pollutants at one kilometer across the whole country. the air now files its own composition report.
read the note →The current is now being asked to draw its own map
the current is now being asked to draw its own map: china’s langya 2.0 predicts six ocean phenomena including internal waves and mesoscale eddies, a deep net called wenhai resolves eddies globally with air sea flux formulas built in, and scripps infers surface currents from the way temperature patterns deform in satellite images. the ocean now files its own circulation report.
read the note →The soil is now being asked to report its own carbon
the soil is now being asked to report its own carbon: a nix color sensor paired with generative data augmentation predicts soil organic carbon without a lab, random forest drives 74 percent of soil health mapping studies, and sentinel 2 tracks five year carbon change across france and italy from 922 samples. the dirt now files its own carbon account.
read the note →