Redbot Labs / Threat Intelligence
ZCode AI Coding Assistant Uploaded Repository Snapshots Without Clear User Consent
- Incident ID
- RBT-TI-0088
- Organization
- Z.ai / Zhipu AI
- Reported Location
- Beijing, China - Vendor Location / Potential Global Developer Exposure
- Severity
- High
- Category
- AI Data Exposure / Unauthorized Repository Upload
- Record Date
- 2026-09-18
Incident Summary
Developer ferstar documented ZCode generating repository snapshots containing Git history and attempting cloud uploads without an effective user-facing opt-out.
A small public repository uploaded successfully. A 313 MB commercial-project archive remained local after failed attempts. The finding concerns unexpected data handling by an AI coding product, not demonstrated theft by an external attacker.
What Happened
Workspace capture
The researcher examined ZCode’s snapshot workflow and found that it packaged repository content, including historical Git data.
Cloud transfer
The workflow encrypted archives for upload to Alibaba Cloud storage using a server-provided encryption key.
Controls and remediation
The researcher reported that relevant settings did not prevent the original capture-and-upload behavior. Subsequent examination found the upload pipeline removed in version 3.14.0.
Evidence limits
The researcher’s successful upload involved a public repository. That observation should not be expanded into a claim that the larger commercial archive was transmitted. Primary research
Affected Systems
Developer Workspaces / Git Repository History / ZCode Snapshot Processing / Cloud Upload Workflow
Attack Vector
Unexpected Background Data Collection / Repository Snapshot Upload / Ineffective Upload Controls
Business Impact
Potential intellectual-property exposure
A repository snapshot can contain more information than the files a developer intentionally provides to an assistant. Historical material may include earlier implementations, internal documentation, or configuration details.
Uncertain scope
The available evidence does not establish a complete count of affected developers or repositories.
No demonstrated downstream theft
This record does not establish malicious third-party access, misuse of uploaded content, or model training on the material.
Review requirements
Organizations using affected software should determine what information was accessible to the tool and distinguish attempted transfers from completed uploads.
Redbot Analysis
Validate what leaves the developer’s machine.
Redbot recommends testing AI development tools with a controlled repository containing identifiable, non-sensitive test files. Observe which files are read, packaged, and transmitted during ordinary prompts, indexing, checkpoint creation, and background tasks.
Include repository history in the assessment.
Review the difference between the current working files and the complete repository. A narrowly scoped user request should not automatically authorize collection of unrelated historical content.
Verify controls through observed behavior.
Test each privacy and indexing setting independently. Confirm whether it prevents collection, prevents transmission, or only changes downstream processing. Document those distinctions so administrators can make informed deployment decisions.
Treat encryption and authorization as separate questions.
Encryption can protect a transfer while still allowing an unintended recipient to receive and process the information. Validation should establish both who can decrypt the data and whether the user authorized its transfer.
Confirm remediation in the deployed application.
Public source code can support review, but organizations should also examine the actual client version they deploy. Repeat the original test and verify that the unwanted behavior has stopped.
