Cyber Security
ZCode Packed Whole Workspaces, Git History Included: What a Developer Found, What Zhipu Changed, and What AI Coding Tools Owe Users
A developer found Zhipu's ZCode app packing users' workspaces, Git history included, into encrypted archives bound for cloud storage. What ferstar reported, how Zhipu responded within eleven days, the similar Grok Build case, and what AI coding tools owe users.
Akmal Alif · 10 October 2026 MYT
On 18 September 2026 a developer who writes as ferstar published Inside ZCode: Silently Uploading Your Entire Git History to the Cloud. ZCode is the AI coding desktop app from Zhipu, the Chinese lab also known as Z.ai and the maker of the GLM models. The post said the app was quietly packing up users' workspaces, including the full .git directory, encrypting them, and sending them to Alibaba Cloud storage (ferstar, 2026).
Within eleven days Zhipu had done five things:
apologised;
removed the feature;
open-sourced the app;
had the deletion of the data checked by two third parties;
compensated users (Wu, 2026).
The technical findings below are ferstar's, from reverse-engineering specific app versions. Nobody has independently audited them. We attribute them accordingly.
What ferstar found
A large, unexplained folder. While freeing disk space, ferstar, a paying subscriber, found ZCode's local data folder had grown past 700 MB. Inside was an encrypted 313 MB archive described as a "baseline" snapshot of a work project. Its metadata recorded 564 failed attempts.
What the archive held. A sample snapshot covered 42,411 files. About 87% of it was Git data: the large-file cache and the full object history. Source code and documents made up the rest, along with hashes of some global app settings files.
How it was sent. ferstar unpacked the app and reconstructed the flow in four steps:
The client asks Zhipu's server for upload credentials.
The server returns a public key and temporary storage credentials.
The client compresses the workspace and encrypts it with a fresh key, which it then locks with the server's public key.
The client posts the result directly to Alibaba Cloud's object storage, which notifies Zhipu's backend.
Because only the server holds the private key, the user cannot open the archive on their own disk.
When it ran. Snapshots were triggered before every prompt and by "Repo Wiki" documentation tasks. One session logged up to 62 capture events.
Settings did not stop it. ferstar reports that the two privacy-related toggles in the app governed training consent and server-side indexing, not capture or upload. The capture component started whenever the user was logged in. The privacy policy mentioned text, files and code submitted in conversations, but not whole-workspace or Git-history snapshots.
An important correction. In a later update, ferstar says the 313 MB work snapshot was never uploaded successfully; it failed 564 times. A small public repository of 538 files was accepted by the server.
How Zhipu responded
The timeline, from ferstar's updates and TechNode's report (Wu, 2026):
18 September. Zhipu apologised, saying the upload mechanism had not been adequately disclosed. It blamed a "codebase indexing" feature used for local indexes, checkpoints and Repo Wiki generation, which had been on by default at launch.
19 September. ZCode 3.14.0 removed Repo Wiki and the paths that generated and uploaded repository snapshots.
20–21 September. Zhipu published the app's source on GitHub under the Apache 2.0 licence and released first-round third-party security results (Z.ai, 2026). It said the data was not retained and never used for training.
23 September. Version 3.14.3 was published with matching public source.
28–29 September. Zhipu announced that all objects in the affected storage bucket, and the bucket itself, had been deleted. The China Academy of Information and Communications Technology (CAICT) and the security firm NSFOCUS verified the deletion. ZCode adopted a "no upload unless initiated by the user" policy, and Zhipu compensated users with quota resets and free token packages.
ferstar's remaining objections are fair ones. Published source code does not prove the shipped binaries match it. A post-incident audit of an emptied bucket cannot show what happened to data before it was emptied.
Not the only one
In July 2026 a researcher found that SpaceXAI's Grok Build command-line tool was uploading entire repositories, including Git history containing deleted secrets, to cloud storage. Elon Musk promised to delete the data; The Register could not verify that it had been (Jones, 2026). Two tools from two countries had the same failure within three months. That suggests a pattern in how AI coding tools are built, not a national quirk.
The pattern is easy to see. Coding agents work better with full repository context, and cloud-side indexing is convenient for the vendor. The risk is in the details:
Git history is the worst part to upload. It keeps everything ever committed, including secrets that were later deleted from the code.
Encryption does not help the user. Encrypting with a key only the vendor holds protects the data from everyone except the vendor.
The wrong switch. A toggle that controls training but not collection leaves the default doing the work.
What AI coding tools owe users
Plain disclosure. Say exactly what leaves the machine, when, and where it is stored.
Off by default for anything beyond the files a user explicitly shares, and above all for whole-repository or Git-history uploads.
Local-first indexing wherever it is technically possible.
A real off switch. It must stop capture and upload, not just training.
Verifiable builds. If a vendor open-sources a client to rebuild trust, users need a way to confirm that the binary they run was built from that source.
What developers can do now
Look at what your tools store and send. Check the app's local data folders for unexpected archives, and the network connections it makes while you work.
Assume history leaks. Keep secrets out of Git, and rotate anything that was ever committed, even if it was later deleted.
Use the strictest settings available, such as zero-retention or enterprise modes, for sensitive code.
Keep the tool current. If you used ZCode before 19 September, update it, and read Zhipu's published audit results with ferstar's caveats in mind.
For the business side of Zhipu's year, including GLM-5.3, see our post on Bloomberg's chart of the US–China AI gap.
References
ferstar. (2026, September 18). Inside ZCode: Silently uploading your entire Git history to the cloud (Updated September 23, 2026). Code is cheap, let's talk. https://blog.ferstar.org/en/posts/zcode-silent-workspace-snapshot-upload/
Jones, C. (2026, July 14). Musk promises purge after Grok Build caught sending entire repos to the cloud. The Register. https://www.theregister.com/ai-and-ml/2026/07/14/musk-promises-purge-after-grok-build-caught-sending-entire-repos-to-the-cloud/5271123
Wu, J. (2026, September 29). Zhipu's ZCode deletes data and announces compensation after data upload controversy. TechNode. https://technode.com/2026/09/29/zhipus-zcode-deletes-data-and-announces-compensation-after-data-upload-controversy/
Z.ai. (2026). ZCode [Source code repository]. GitHub. https://github.com/zai-org/ZCode