ZCode packaged 42,411 workspace files for cloud upload, researcher finds

The 313MB archive was encrypted for a Z.ai-held key, while the app's privacy controls did not stop packaging or retries.

By · Published

Primary source: Tokenstead

Why it matters

Coding agents need broad repository access to work, but ZCode's reported snapshot pipeline puts the desktop runtime - including what it collects and who holds the keys - at the center of developer trust.

A close-up photograph of a computer monitor on a developer's desk, displaying abstract visualizations of digital data being transferred.

ZCode, the desktop coding agent from Z.ai, a Tsinghua-born AI company led by CEO Zhang Peng and co-founded by computer scientist Tang Jie, repeatedly tried to upload a developer's full workspace, including its Git history…

When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.

Reader comments

Conversation for this story loads after sign-in.