开发者ferstar于2026年9月18日披露，Z.ai公司的AI代码编辑器ZCode存在严重隐私漏洞1。该应用在用户登录时会自动打包用户整个工作区内容，包括完整的Git历史、LFS缓存和反日志等敏感数据，随后加密上传至阿里云OSS服务器，而用户无法解密这些上传内容1。
根据ferstar的调查，一份上传的加密档案大小为313MB，包含42,411个文件，其中Git目录占比高达86.6%1。在单个活跃会话中，该应用记录了62次捕获事件，这些事件在用户提出提示前和任务完成时被触发1。上传过程中共记录了564次失败尝试1。ZCode采用信封加密机制，用RSA-OAEP公钥包装对称密钥，但私钥仅由Z.ai云端服务器持有1。根据ferstar的结论，这意味着"只有服务器能使用的密钥，目的就是确保服务器可以随时读取你的代码"1。
ZCode的应用界面中虽然提供了相关设置开关，但这些开关并未能真正禁止数据上传1。"优化体验"开关仅控制数据是否用于模型训练，"仓库快照索引"开关只控制服务器是否对数据进行索引，但上传行为在两种情况下都会继续进行1。公司的隐私政策声明仅提及收集"对话中提交的文本、文件和代码"，并未披露会上传整个工作区和Git历史1。
该披露在社交媒体上引发广泛关注，ferstar的帖子获得276,000次浏览，相关的中文警报贴获得63,800次浏览1。Z.ai团队随后回应称"hey I am sorry to let you find it"1。此外，Z.ai公司于2026年1月在香港交易所上市1。
Security researcher ferstar disclosed on September 18, 2026, that ZCode, an AI code editor developed by Z.ai, has been covertly uploading users' entire workspace to Alibaba Cloud's OSS infrastructure without their knowledge or consent 1. The uploaded data, totaling 313 megabytes across 42,411 files, includes complete Git history, LFS cache, and application configuration extracted from a 345-megabyte workspace 1. The files are encrypted using envelope encryption with symmetric keys wrapped by RSA-OAEP public key encryption, but the decryption keys are held exclusively on Z.ai's servers, meaning only the company can access the contents 1.
The disclosure revealed that the upload behavior occurs automatically each time a user logs in and cannot be disabled through the application's user interface 1. Within a single active session, the researcher documented 62 separate capture events triggered before prompts and upon task completion 1. The company's UI settings, including options labeled "optimize experience" and "repository snapshot index," only control whether the data is used for model training or indexed by servers—they do not prevent the uploads themselves 1. Git directories comprise 86.6 percent of the uploaded data, and the researcher documented 564 failed upload attempts 1. Z.ai's privacy policy discloses only the collection of "text, files, and code submitted in conversations," making no mention of workspace or Git history uploads 1.
When confronted, the ZCode team responded with "hey I am sorry to let you find it," which the researcher interpreted as a confirmation of the mechanism rather than a denial 1. The disclosure gained significant traction on social media, with ferstar's original post receiving 276,000 views, while a Chinese-language alert by user FeiZ accumulated 63,800 views 1. Z.ai went public on the Hong Kong Stock Exchange in January 2026 1.
评论
还没有评论，欢迎留下第一条。