Z.ai has open-sourced the ZCode coding-agent stack after a report that its desktop client could generate repository snapshots containing Git history and upload data through a disputed Repo Wiki workflow. The company says it removed the path in v3.14.0, but public documentation still describes related behavior, so the source release improves auditability without independently proving that every affected binary is clean.
Key facts
- ZCode now publishes the desktop app, web workspace, backend, UI, Agent CLI and runtime source.
- The repository is Apache-2.0 and its changelog dates v3.14.0 to 19 September 2026.
-
Feedback issue #707 alleged repository snapshots included
.git/objects,.git/logsand.git/refs. - Z.ai says v3.14.0 removed the Repo Wiki entry point and repository-snapshot workflow; the claim has not received a complete independent audit.
The release is substantial. ZCode is not a publication of GLM weights; it is the software around a coding agent: desktop and web clients, backend, shared interface, command-line agent and runtime. Its LICENSE identifies Apache-2.0 terms, and the changelog lists v3.14.1 on 21 September. That gives users and security researchers a real codebase to inspect, rebuild and modify.
The security context is why that transparency matters. The issue reporter alleged that a logged-in ZCode Desktop client generated a snapshot containing Git internals, including object data, logs and refs, and that this could occur while repoSnapshotIndexingEnabled was false. If reproduced, that is not merely a UX problem. Git metadata can expose commit history, branch names, author details, removed secrets or code that a developer did not intend to provide to an assistant. An AI tool that gathers code context is like a contractor entering an office: the intended document is one thing, but access to filing cabinets and waste bins is another.
Z.ai’s published position is that remediation was completed in v3.14.0. A company statement reproduced in a Reddit announcement says the Repo Wiki entry point and associated snapshot-generation workflow were removed after reviews. The changelog uses narrower language: it says the release fixed “abnormal uploads in the repository wiki.” Both are company claims, not a third-party verification of every runtime path.
The unresolved documentation conflict is concrete. ZCode’s current Repo Wiki documentation still says the feature sends filtered code context to a selected model service and stores generated output locally under ~/.zcode/v2/repo-wiki/<workspace-hash>/wiki.json. It says “Delete wiki” clears local content. This could be stale documentation, a remaining different feature path, or an incomplete public description. It does not prove the original alleged upload still exists, but it means the categorical remediation story is premature.
Z.ai’s privacy policy says user content can be processed to provide, analyze and maintain the service, and says training/optimization use is opt-in. It does not specifically settle repository snapshots or Git history. The most useful company quote is the claim in its remediation statement that “no functional path” for snapshot generation or local-file transmission was identified. That deserves testing, not automatic acceptance.
The counterargument is strong: open source provides a path for independent inspection and a downstream fork can remove unwanted behavior. The caveat is equally strong: source visibility does not prove shipped binaries, third-party dependencies, generated assets, telemetry or network egress have been audited. Security-conscious teams should test the released client in a disposable repository, observe outbound traffic, control credentials and inspect actual context collection. This is a practical AI supply-chain case: a settings toggle is not a security boundary unless the code and network behavior enforce it.
Originally published on Ground Truth, where every claim is checked against the primary source.
