What happened
Legitimate ZCode sessions reportedly packaged local project workspaces and Git histories and uploaded them to cloud servers without an explicit user approval for that transfer.
2026-09-18
HighMedia reportZ.ai Disabled ZCode Features After Reports the Coding Agent Uploaded Local Repositories Without Consent
Z.ai disabled coding-assistant features after users reported ZCode packaging and uploading local repositories and Git histories without explicit consent.
Z.ai ZCodeGovernance bypassAgent-initiated developer workspace upload without explicit user consentZCode's local developer workspace scanning, packaging, and cloud-upload features
Why it matters
Potential exposure of proprietary source code, commit history, configuration, and secrets present in local repositories; Z.ai disabled features and apologized while investigating.
Missing authorization check
An explicit, separately recorded user decision for the exact files and repository history before any outbound upload.
Would PP block it?
The upload client would present a manifest hash and destination to an external authorization service before sending bytes. A background packaging or sync path with no matching user-approved receipt would fail closed. Permission Protocol would not determine whether the selected content contains secrets or repair ZCode's local data-handling code.
Incident analysis
Timeline and technical read
Timeline
2026-09-18
A Chinese technical blogger reported finding packaged local workspace data while inspecting a ZCode directory.
2026-09-21
Z.ai said it had disabled affected coding-assistant features, apologized, and was investigating user reports of repository uploads without consent.
2026-09-22
Reuters and Cyber Magazine published reports on the feature shutdown and reported data-transfer behavior.
Technical breakdown
- Reports described local project workspaces and Git histories being packaged by the coding assistant.
- The packaged data was reportedly uploaded to overseas cloud servers without a distinct consent step for the transfer.
- Z.ai disabled some coding-assistant features after the reports and said it was investigating.
- Public sources did not disclose the upload endpoint, implementation path, exact affected versions, or confirmed downstream access.
Authorization boundary
Where the authorization boundary should have been
This incident is categorized as Governance bypass. The relevant Permission Protocol gate is Tool-Call Gate. The read is conditional: the block only applies where the real action boundary is routed through a gate.
- If enforced at
- ZCode's outbound upload boundary after file selection and before any workspace archive leaves the device
- Still needs
- Endpoint controls, secret scanning, data minimization, retention and deletion guarantees, and investigation of already uploaded material remain necessary.
- Receipt required for
- Uploading the named workspace files and Git history to the specified cloud destination for a declared purpose and bounded retention period
A Tool-Call Gate at the upload boundary can require a receipt scoped to the exact file set, destination, purpose, and expiry before the agent transfers local data.
Related incidents and controls
Start small
Put the relevant gate at this action boundary.
This incident maps to Tool-Call Gate. Start with the boundary that controls the actual action, then require a signed receipt before execution.