Z.ai banked $5.02bn days before its coding assistant was caught packaging Git histories

On 18 September a developer publishing as ferstar traced abnormal disk usage to ZCode, Z.ai's coding assistant, and found a 313MB encrypted snapshot of a commercial project in a local checkpoints directory↗, its log showing 564 failed upload attempts ¹. The snapshot held 42,411 files, 86.6% of them Git directories, including 102.2MB of objects carrying the project's full commit history ¹.

The money had already cleared

The capital landed first. On 13 September a filing showed Z.AI had sold 21.97 million new Hong Kong shares at HK$714↗, a 10% discount, plus RMB20.14bn of zero-coupon convertible bonds due 2027: US$5.02bn combined, the third deal of the year and the one taking 2026 past US$9bn in total ²³.

About 60% of net proceeds funds next-generation models and a fully self-training system ². Convertible buyers accepted a yield between minus 0.5% and zero↗ for the right to convert at a 25% premium ⁴. The HK$714 price sits below half July's HK$1,588 placement level, and the stock has shed nearly half its value since briefly topping a HK$1 trillion market cap in June ⁵⁸.

Keys the customer never held

ZCode encrypted file contents with AES-256 and wrapped the key with RSA, fetching the public key from Z.ai's own servers; the private key stayed with the vendor, so users could not open their own files or independently confirm deletion ¹⁷. Snapshots were addressed to an Alibaba Cloud bucket called zcode-prod, with no toggle to switch the capture off and nothing in the privacy policy about workspace snapshots↗ ⁶⁷.

The bucket's host is Alibaba: the same company that in July banned Claude Code over alleged covert tracking of Chinese users ¹⁷. Chengming Technology said six of its coding workspaces had gone to the cloud, complete source code, database passwords and employees' personal information among them; on Monday it retracted the claim, citing "wrong evidence" ⁷.

The fix is real, and it is missing its memory

Z.ai disabled the workflow, shipped ZCode v3.14.0, open-sourced the tool and switched on zero-data retention; an industry-ministry think tank and security firm NSFOCUS verified the bucket and its contents gone ⁶⁷. Ferstar's second look confirms the upload pipeline is removed ¹.

But the published repository carries two commits. The development history is gone, and so is the code that did the uploading. The only party able to verify the deletion is the party that did the deleting. No one has said how many workspaces were captured or for how long, and the promised full assessment report has no date beyond "soon" ¹⁷.

A safety-first public record, priced for buyers who came for the economics

The response is unusually complete: two apologies, an open repository, rewards for researchers ¹⁷. This is also the lab that held GLM-5.3 back two weeks for safety review, a first for a Chinese developer ⁷.

The economics are thinner than the raise suggests. First-half revenue quintupled to $142M↗, the net loss narrowed to 2 billion yuan, and J.P. Morgan expects adjusted profit only in 2028 ⁸. No independent report carries an API price for GLM-5.3 against OpenAI's ⁴; against $9bn raised this year, the public sales record is one $142M half ³⁸.

The same charge, countries swapped

xAI's Grok Build was caught uploading whole repositories in July; Chinese state bodies called Claude Code's covert tracking a serious threat ¹. September's version of the charge landed on China's open-source champion, days after the NSA, FBI and CISA alleged industrial-scale distillation by Z.ai, which Beijing called unfounded ⁴. Watch the report's date, whether the repository's history stays gone, and what enterprise buyers conclude about a frontier model whose deletion claims only the vendor could check.