Z.ai's coding agent swallowed 42,411 files, and the developers got the bill

Two Z.ai stories ran through the same fortnight and never touched. The first is a trust scandal: ZCode, the company's coding agent, was caught packing a developer's entire workspace into an encrypted archive and logging 564 failed attempts↗ to upload it to Alibaba Cloud ¹².

The second is a commercial account: a company-built AI agent standing up inference on more than 100,000 Chinese-made accelerators ³, under a listing that had compounded to near nine times its January IPO price by late August ⁴. Developers are paying for the first. The second is the business.

The capture ran unconditionally, sealed with a key only Z.ai held

On 18 September 2026 the developer who writes as ferstar traced a swollen ZCode directory to a 313MB encrypted snapshot of a commercial project: 42,411 files, the bulk of it Git history and cached assets ¹²⁵. The archive sat pending after 564 failed uploads; a second snapshot, a 538-file public repository compressed to about 15KB, did reach Alibaba's storage ¹².

The contents were sealed with AES-256-CTR, the key wrapped with RSA-OAEP, its private half held only on Z.ai's servers, so neither ferstar nor the ZCode client could open what had been taken ¹²⁶. Capture ran unconditionally: the two visible settings governed downstream use, not whether the snapshot was taken ¹. Z.ai traced the origin to a "Codebase Indexing" feature enabled by default↗ ⁷.

Deletion attested by the deleter

Version 3.14.0 removed the Repo Wiki entry point and the repository-upload workflow, and the source shipped on GitHub under Apache-2.0 ⁶⁸⁹. CAICT, the ministry-affiliated assessment body, found the zcode-prod bucket in a zero-data state↗, and NSFOCUS confirmed the bucket and every object in it deleted ⁸⁹. Z.ai says the data "has never been used for model training" and has promised the full assessment reports ⁶⁹.

The published repository carries two commits: the development history and the upload code are gone, so the old behavior can no longer be inspected ¹⁶. Nobody has said how long it ran or how many workspaces it captured ¹. A leading Chinese robotics firm has banned Z.ai's tools internally ¹⁰. The gravest corporate allegation, six workspaces including database passwords, was retracted by its own author as wrong evidence ¹⁷.

The machine never stopped

A day before ferstar's post, Z.ai described GLM-5.3-Flash reaching production on that 100,000-plus accelerator cluster in under two weeks, with throughput roughly tripled, after the model processed 62 trillion tokens in six days as the anonymous Ox Alpha; the figures are the company's own ³⁴. The listing, Knowledge Atlas Technology until July, priced at HK$116.20 and traded near HK$1,100 in late August, on 2025 revenue of 724.3 million yuan against a 4.7 billion yuan net loss ⁴.

Through the scandal's own week, a 26 September Hong Kong Connect flow note↗ still featured the stock among its highlighted names; the direction of those flows sits behind a paywall, so whether mainland money was buying or selling cannot be read from it ¹¹.

Every attestation comes from the party that held the key

The trust bill is itemized to the file. The compounding is itemized to the token. Deletion is attested by the only party that ever held the key, the training denial is the company's word, and the full CAICT and NSFOCUS reports have no release date ¹⁶⁸. Until they surface, the ledger closes on one signature.