September 18, 2026 — Analysis / Research
The ZCode controversy is not primarily a story about whether cloud-based AI tools transmit data. Many coding assistants necessarily send task-relevant material to remote services. The more consequential question is whether users can know, control and independently verify what leaves their machines, when it leaves, where it goes, and how long it remains there.
A reverse-engineering report published by developer Ferstar alleged that ZCode, an AI coding desktop application associated with Zhipu AI/Z.ai, could package an entire workspace — including source files, complete .git history, Git LFS material, reflogs and application configuration — encrypt the archive and upload it to Alibaba Cloud OSS while the user was logged in. The report also alleged that the encryption public key was supplied by the service and that the corresponding private key remained server-side.
Those claims come from one technical investigation and subsequent community attempts to reproduce aspects of the behavior. They should not be generalized to every installation, every ZCode version or every user environment without further controlled testing.
Zhipu’s response narrows some questions but leaves others open
Zhipu later apologized to affected users and said the issue originated in ZCode’s code-repository indexing system. According to the company’s explanation, the Repo Wiki feature could trigger repository-data uploads when generating cloud-based Wiki pages. The company said that uploaded data used for this purpose was destroyed after page generation, that the feature had initially been enabled by default, that the issue had been fixed, and that ZCode would be open-sourced and subjected to third-party review.
The response is important because it acknowledges that repository data could leave the user’s device under a feature that had been enabled by default. At the same time, the public explanation does not yet independently establish the full upload scope observed by the reverse-engineering report, nor does it by itself verify deletion timing or reconcile every claim concerning Git-history material.
The governance problem is consent plus verifiability
For organizations using AI coding agents, three separate controls matter:
- Scope control: exactly which files, directories, history objects, credentials and metadata can be transmitted.
- Consent control: whether transmission requires an explicit, understandable opt-in rather than a default-enabled feature or an unrelated login state.
- Verification control: whether users, enterprise administrators and independent auditors can confirm what the software actually transmits and whether retention/deletion claims are technically testable.
This is especially important for source-code environments because repository history can contain material no longer visible in the current working tree, including deleted code, old credentials, internal endpoints, proprietary designs and historical configuration.
Why this belongs in FreeChina.live’s information-control research
The case should not be mislabeled as a Great Firewall incident. No published evidence reviewed by FreeChina.live establishes that authorities directed or actually accessed the ZCode uploads. At the same time, the observed architecture supports a narrower state-surveillance risk claim: server-decryptable repository uploads create a technical pathway through which sensitive source-code data could become accessible to third parties. In mainland China, Article 35 of the Data Security Law provides that relevant organizations and individuals shall cooperate when public-security or national-security organs lawfully obtain data. The combination of observed cloud upload behavior and that legal-access framework is sufficient to identify a plausible surveillance risk, but not to claim that state access occurred in this case.
Its relevance is broader: modern information control is increasingly shaped by platform architecture, account identity, cloud routing, default settings, data retention and opaque service behavior as well as by blocking and deletion. A system can create serious information-security or user-control concerns even when it is not itself censoring content.
The case therefore sits at the intersection of AI governance, cloud data flow, consent, platform transparency and information-control infrastructure.
What responsible AI coding-agent design should disclose
At minimum, users and enterprise administrators should be able to determine:
- what categories of local files and repository history may be uploaded;
- which feature triggers each transmission;
- whether any feature is enabled by default;
- the cloud destination and relevant data processor;
- who can decrypt uploaded data;
- the retention and deletion policy;
- whether users can disable uploads without disabling unrelated functionality;
- whether deletion and retention claims can be independently audited; and
- whether source code or repository history is used for training, indexing, analytics or any secondary purpose.
What evidence should come next
The strongest next evidence would be the promised open-source release, a reproducible comparison of pre-fix and post-fix builds, independent network traces, a third-party audit with methodology, and precise documentation of upload scope and deletion behavior. Until then, claims about the technical mechanism should remain tied to specific tested versions and evidence.
Related FreeChina.live coverage
- News: ZCode Repository-Upload Controversy Raises New Questions About Data Control Behind Mainland China’s Digital Firewall
- Great Firewall of China: Technical History, Censorship Mechanisms, Cases, Data and Circumvention
- China Information Control & Circumvention History
Sources
- Ferstar — reverse-engineering report on ZCode workspace snapshots
- IT之家 — ZCode response, remediation and open-source / third-party-review announcement
- DoNews — reporting on the upload-scope controversy and unresolved questions
Evidence note: This analysis distinguishes observed or alleged software behavior from the vendor’s own explanation and from broader claims about censorship or government surveillance. FreeChina.live will update the record as stronger reproducible evidence becomes available.