Z.ai Open-Sources ZCode After Codebase Indexing Uploaded Local Repositories

By AiCybr Editorial · Published September 22, 2026

Z.ai has open-sourced ZCode under the Apache 2.0 license after developers reported that the AI coding environment uploaded local repository data to cloud infrastructure without explicit consent. Z.ai attributed the behavior to its Codebase Indexing and Repo Wiki workflow, patched the affected path, and subsequently published the ZCode client, backend, shared UI, Agent CLI and runtime source code on GitHub.

The public repository was created on September 20, 2026. ZCode 3.14.0, released September 19, lists a fix for an abnormal repository-Wiki upload issue. Version 3.14.1 followed on September 21 with unrelated bug fixes. Developers using older ZCode builds should update before continuing to use the coding environment with private repositories.

The incident matters because an AI coding agent can operate inside repositories containing source code, Git history, configuration and credentials. ZCode's newly published source also documents its current execution and network boundaries, giving security teams substantially more material to inspect before allowing the tool on sensitive workstations.

What happened

Z.ai told Reuters that the issue originated in ZCode's Codebase Indexing feature, which had been enabled by default. Developers reported local code repositories being sent to Alibaba Cloud without their consent. Z.ai said it patched the vulnerability and disabled affected features, then open-sourced ZCode to make its behavior more transparent.

An independent wire-level investigation published before the remediation documented workspace snapshots containing repository files and Git history being packaged and uploaded during the affected workflow. Z.ai's subsequent statements said repository data used to generate Wiki pages was destroyed after processing and was not used for model training.

Z.ai also said assessments by the China Academy of Information and Communications Technology and NSFOCUS found that the relevant cloud bucket contained no retained user-code data after remediation. That finding establishes the post-remediation storage state reported by the company and its assessors; it does not provide a complete historical access log for data processed before the fix.

What changed in ZCode 3.14.0

ZCode's official changelog lists 3.14.0 on September 19 and explicitly records a fix for the repository-Wiki upload problem. The release also added dynamic multi-agent workflows, Office and Coding modes, revised shortcut settings and other product changes.

The current download page lists 3.14.1 as the latest release. ZCode provides desktop builds for macOS, Windows and Linux, including x64 and Arm64 variants where documented.

For organizations that installed ZCode before 3.14.0, the practical response is to update to the current release and review whether sensitive repositories were opened while the affected indexing workflow was present. Repository secrets should be rotated when there is evidence that exposed files contained active credentials; rotation decisions should be based on the files and credentials actually present in the affected workspace.

The open-source release changes what teams can inspect

The new zai-org/ZCode repository is licensed under Apache 2.0 and contains the desktop client, browser interface, backend services, shared UI, Agent CLI and runtime. Z.ai's README documents three principal operating surfaces: an Electron desktop application, a local browser workspace and a terminal agent.

Building the current source requires Node.js 24.14.0 and pnpm 10.33.2. The command-line distribution can launch a terminal interface with zcode or a local browser workspace with zcode --web. Web mode listens on 127.0.0.1 by default; when configured to listen on a non-local address, ZCode generates an access token by default unless that behavior is explicitly changed.

This publication makes client-side data paths and permission logic auditable. Server-side systems operated by model providers, cloud services or Z.ai remain separate trust boundaries and require their own controls and contractual assessment.

ZCode's current execution boundary

ZCode's published NOTICE.md is unusually detailed about agent permissions. It states that the shared agent execution adapter does not provide a default operating-system sandbox. File, terminal, Git, Agent and external-process tools can act with the permissions of the OS account running them.

The notice also documents a consequential CLI default: a standalone non-interactive invocation using --prompt without an explicit --mode uses yolo mode. In that configuration, ordinary tool operations can proceed without the same per-action interaction expected from a tightly constrained read-only planning workflow.

Teams evaluating ZCode for proprietary repositories should therefore treat OS-account permissions, workspace credentials, network access, MCP servers, plugins and lifecycle hooks as part of the security design. A dedicated low-privilege development environment or disposable VM/container boundary can reduce the impact of an agent or project instruction executing an unsafe operation.

Security checklist for existing deployments

Upgrade to the current ZCode release. The official changelog identifies 3.14.0 as the release that fixed the repository-Wiki upload issue; 3.14.1 is currently listed as the latest build.
Review repositories used with affected builds. Identify whether workspaces contained credentials, private keys, tokens, database passwords or other secrets that warrant rotation.
Audit outbound access. Enterprise deployments can use endpoint, proxy and DNS telemetry to establish which external services ZCode contacted during the relevant period.
Use least-privilege execution. Run coding agents with only the filesystem, credentials and network access required for the task.
Review automation modes and extensions. ZCode's own notice documents broad capabilities for hooks, MCP connections, plugins, shell commands and background workflows. These expand the effective trust surface beyond model chat alone.
Inspect the source for policy-sensitive deployments. The Apache-licensed repository now exposes the client and agent runtime needed for internal review and reproducible builds.

Bottom line

ZCode's open-source release materially improves inspectability after a serious developer-data handling incident. The strongest immediate controls are straightforward: run a current build, review exposure for repositories opened on affected versions, rotate credentials when the repository contents justify it, and apply least privilege to agent execution.

The public source also shows that safe deployment depends on more than the fixed indexing path. ZCode is an execution-capable agent environment with terminal, Git, hooks, MCP and network access, so organizations should evaluate it with the same endpoint and software-supply-chain controls used for other developer tools that can execute code.