---
title: 'In the News: September 19, 2026'
description: "A teardown of Zhipu's ZCode found it uploading whole repositories, git history included, under a key only the vendor holds. Zhipu has apologised."
canonical_url: 'https://darkfactory.dev/news/2026-09-19-extra'
markdown_url: 'https://darkfactory.dev/news/2026-09-19-extra.md'
collection: news
date_published: '2026-09-19T10:45:00-04:00'
date_modified: '2026-09-19T10:45:00-04:00'
---

# In the News: September 19, 2026


A reverse engineering write-up published on September 18 says Zhipu's ZCode
desktop app packaged an entire working repository, git history included, and
uploaded it encrypted under a key only Zhipu's servers hold. Zhipu apologised
the same day and says the behaviour is fixed, though its account of what
happened and the researcher's do not match. TypeSafe's customer agreement also
forbids publishing benchmarks of Jev, the decision model it is selling for use
inside software pipelines.

## 1. ZCode uploaded repositories while its related settings controlled other behavior

**[Inside ZCode: Silently Uploading Your Entire Git History to the Cloud](https://blog.ferstar.org/en/posts/zcode-silent-workspace-snapshot-upload/)** · ferstar · Code is cheap, let's talk, September 18, 2026

ferstar says he found the archive while clearing disk space: a 313,070,842 byte
encrypted file in `~/.zcode/v2/checkpoints`, beside a state file recording a
345,549,173 byte workspace and 564 failed upload attempts. The packing manifest
is written locally in plaintext even though the archive is not, and it breaks
the snapshot down to 42,411 files, of which `.git` accounts for 86.6 percent:
LFS cache at 56.8 percent, the object store at 29.6 percent, reflogs at 0.2
percent. Content is encrypted with AES-256-CTR under a key wrapped by an RSA
public key the server supplies at upload time, so the private key never reaches
the machine and the file cannot be opened by the user or by the client. He
reports that the two settings that look like they govern this, labelled
Optimize Experience and Repo Snapshot Indexing, control training authorization
and server-side indexing instead, that the upload process starts unconditionally
at launch and needs only a valid login token, and that one active session logged
up to 62 capture events, with a capture triggered before every prompt. His
reading of the design: it "looks less like backup and far more like collection."

Zhipu apologised on September 18 in a statement issued through its official user
group and reported by IT Home, saying it had completed a self-inspection and
that the problem is fixed. Its description of the mechanism differs. Zhipu
attributes the uploads to the repository indexing feature, says the Repo Wiki
function can trigger a repository data upload, says uploaded data is destroyed
once the wiki page has been generated in the cloud, and says the feature was on
by default when it launched. The company also said it will open source the
ZCode codebase and invite third-party reviewers, and gave every user an extra
weekly quota reset. The GitHub issue demanding answers was still open with no
reply from the company when this edition was written.

**Why it matters:** The two accounts disagree about the scope and trigger of
the uploads. Publishing the client code would let outside reviewers test both
accounts. Until then, the checkable evidence comes from the client's state
files and the contents of its bundle. The app's settings did not give the user
a reliable way to tell whether repository data would leave the machine.

## 2. TypeSafe's customer agreement forbids publishing benchmarks of its decision model

**[Master customer agreement](https://typesafe.ai/legal/mca)** · TypeSafe AI · last updated August 27, 2026

Section 2.3 lists what a customer will not do. Clause (f) is that customers will
not "publish benchmarks or performance information about the Services." Clause
(c) separately bars reverse engineering or deriving the underlying ideas,
algorithms or structure. Two other sections give that restriction force.
Section 6 lets TypeSafe suspend a customer's access immediately on a Section 2.3
breach. Section 12.3 puts a Section 2.3 breach outside the liability cap, which
otherwise limits each party to the greater of twelve months of fees or fifty
dollars. TypeSafe sells Jev as a System One model for fast, typed,
confidence-aware decisions in software, meaning a component that sits inside a
pipeline.

**Why it matters:** Customers can benchmark Jev against alternatives, but the
contract prevents them from publishing the results for outside scrutiny. A
breach of that restriction sits outside the agreement's liability cap. Teams
should account for that clause before putting Jev into a harness.

## Also this cycle

- **[Claude Code 2.1.277](https://code.claude.com/docs/en/changelog)** · Anthropic,
  September 18 · Claude Code now reads AGENTS.md in a project that has no
  CLAUDE.md, changeable under Project instructions in `/config`, and not yet
  available on Bedrock, Vertex or Foundry. Claude Code uses AGENTS.md only when
  no CLAUDE.md exists, so a team keeping a second instruction file only to
  satisfy Claude Code can drop it.