{
  "entry": {
    "kind": "vuln",
    "slug": "zcode-z-ai-silently-uploaded-encrypted-full-workspace-snapshots",
    "name": "zcode-z-ai-silently-uploaded-encrypted-full-workspace-snapshots",
    "vendor": "ZCode desktop",
    "description": "On 18 September 2026 blogger ferstar, a paying Z.ai Coding Plan subscriber, reported that the ZCode desktop client builds encrypted full-workspace snapshots and uploads them to the cloud. The snapshots include the .git directory (about 86.6% of the payload, with object store, reflogs and LFS cache) as well as source and docs; ferstar found a 313 MB .enc archive for a commercial project in ~/.zcode/v2/checkpoints and unpacked app.asar to reconstruct the flow. The client requests OSS form credentials and a server public key from zcode.z.ai /api/v1/snapshot/upload-credential, encrypts the archive with AES-256-CTR wrapped by RSA-OAEP, and posts it directly to Aliyun OSS. In 3.12.3 the upload reportedly ran whenever the user was logged in, the \"Optimize Experience\" and \"Repo Snapshot Indexing\" toggles did not stop it, and the privacy policy did not mention it. Z.ai said the same day that the uploads came from on-by-default codebase indexing and Wiki generation, that \"some users\" were affected, that uploaded data is destroyed after generation, and that the issue was fixed; a 21 September update cites audits saying 3.14.0 removed snapshot upload. Nothing published establishes what happened to data uploaded before 18 September.",
    "website": "https://blog.ferstar.org/en/posts/zcode-silent-workspace-snapshot-upload/",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": null,
    "configFiles": null,
    "category": "agent",
    "updatedAt": "2026-09-18",
    "risk": {
      "score": 75,
      "band": "high",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "zcode-z-ai-silently-uploaded-encrypted-full-workspace-snapshots",
      "aliases": [
        "ti-123"
      ],
      "title": "ZCode (Z.ai) Silently Uploaded Encrypted Full-Workspace Snapshots, Including .git History, to Aliyun OSS",
      "summary": "On 18 September 2026 blogger ferstar, a paying Z.ai Coding Plan subscriber, reported that the ZCode desktop client builds encrypted full-workspace snapshots and uploads them to the cloud. The snapshots include the .git directory (about 86.6% of the payload, with object store, reflogs and LFS cache) as well as source and docs; ferstar found a 313 MB .enc archive for a commercial project in ~/.zcode/v2/checkpoints and unpacked app.asar to reconstruct the flow. The client requests OSS form credentials and a server public key from zcode.z.ai /api/v1/snapshot/upload-credential, encrypts the archive with AES-256-CTR wrapped by RSA-OAEP, and posts it directly to Aliyun OSS. In 3.12.3 the upload reportedly ran whenever the user was logged in, the \"Optimize Experience\" and \"Repo Snapshot Indexing\" toggles did not stop it, and the privacy policy did not mention it. Z.ai said the same day that the uploads came from on-by-default codebase indexing and Wiki generation, that \"some users\" were affected, that uploaded data is destroyed after generation, and that the issue was fixed; a 21 September update cites audits saying 3.14.0 removed snapshot upload. Nothing published establishes what happened to data uploaded before 18 September.",
      "severity": "high",
      "cvss": {
        "score": null,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Data exfiltration"
      ],
      "componentType": "agent",
      "component": {
        "name": "ZCode desktop",
        "vendor": null,
        "package": null,
        "ecosystem": null,
        "catalogSlug": null
      },
      "affected": [
        {
          "range": "ZCode desktop 3.12.3 reported affected; snapshot upload reported removed in 3.14.0 (3.14.3 checked clean by the author).",
          "fixed": "3.14.0"
        }
      ],
      "exploited": false,
      "exploitPublic": false,
      "publishedAt": "2026-09-18",
      "modifiedAt": "2026-09-18",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "article",
          "url": "https://blog.ferstar.org/en/posts/zcode-silent-workspace-snapshot-upload/"
        }
      ],
      "mitigation": "Upgrade ZCode to 3.14.0 or later, or remove it from machines holding proprietary code until its data handling is approved. Inventory which repositories were opened in ZCode 3.12.x while logged in, treat their full git history (including any secret ever committed) as uploaded, and rotate those secrets. The author's stopgap is making ~/.zcode/v2/checkpoints immutable (chflags uchg on macOS, chattr +i on Linux), since deleting the pending archive does not work, at the cost of ZCode's checkpoint rollback. Watch developer endpoints for traffic to zcode.z.ai /api/v1/snapshot/upload-credential and to Aliyun OSS.",
      "detectedByAnomity": true
    }
  }
}