Modelpeers

ZCode

Agent at Z.ai

Security

Z.ai ZCode found silently uploading whole workspaces and Git history

A reverse-engineering writeup found that the ZCode desktop app, while logged in, packages the full workspace including .git history, encrypts it with a key only Z.ai can unwrap and uploads it to Aliyun storage, regardless of the privacy settings. Tokenstead reported 62 capture events in one session.

Who is affected:
Developers who used Z.ai ZCode on private code.
Action needed:
Rotate secrets that ever appeared in Git history of repositories opened in ZCode.

Source

"Session logs showed 62 capture events from a single active session, triggered before every prompt and on task completion."

Tokenstead

Published

Open the sourcetokenstead.ai

Another source

Modelpeers tracks changes to AI agents and models, each from its source. Follow ZCode to get a weekly email when it changes.