ZCode uploads your entire git history

On September 18, 2026, researcher ferstar reverse-engineered ZCode, the AI coding app from Beijing-based Z.ai, and found it silently packages your complete workspace including git history, LFS assets, and configs, then encrypts and uploads it to Alibaba Cloud.

Open weights don't mean open trust

GLM models from Z.ai are open source, but ZCode itself is closed. Many developers confused the open weights with an open application, not realizing the runtime harness around the model is proprietary.

The encryption key lives only on Z.ai's servers

ZCode uses envelope encryption: your data is encrypted with a symmetric key, which is then wrapped with an RSA public key from Z.ai's servers. The private key to decrypt it never leaves Z.ai's cloud, making the data unreadable to you or the client.

“A key that only the server can use serves exactly one purpose: making sure the server can read your code whenever it wants.”

Your git history is years of secrets

The upload includes your complete .git directory, which contains deleted API keys, unpushed branches with unreleased product plans, internal hostnames, and repo paths. A 313MB archive captured 42,411 files and years of engineering history, not just your current files.

The upload happens automatically

ZCode packages and uploads your workspace 62 times per session, triggered before every prompt and on task completion. The client maintains persistent connections to Z.ai and Alibaba Cloud servers throughout your work.

Settings don't actually stop it

The Optimize Experience toggle only controls whether data is used for training. The Repo Snapshot Indexing toggle only controls server-side indexing. Both uploads continue regardless of these settings because the capture sidecar runs unconditionally at startup.

The privacy policy doesn't mention it

ZCode's privacy policy only mentions collecting text, files, and code from conversations. It makes no mention of packaging entire workspaces and git histories, despite this being the core behavior.

Z.ai promised no spyware

Z.ai launched ZCode in July 2026 as an alternative to Claude Code after Anthropic's hidden-telemetry controversy. An executive said the company would not implement anything beyond what's listed on the website. Workspace snapshotting is not listed.

The company went public in Hong Kong

Z.ai listed on the Hong Kong Stock Exchange in January 2026. When ferstar published the findings, the official Z.ai account did not respond, but a ZCode team account replied with what appeared to be a confirmation rather than a denial.

The fix requires filesystem permissions

Deleting the archive doesn't work because ZCode recreates it within 30 minutes. The only working fix is making the checkpoints directory immutable at the kernel level using chattr on Linux or chflags on macOS, which disables the checkpoint rollback feature.

Local models need local runtimes

Running open-weight models locally means nothing if the harness around them phones home to the vendor's cloud. The runtime, desktop app, and update pipeline are part of the trust surface. A locally-running model in a cloud-connected harness is not actually local.

Two questions for every harness

What does the runtime transmit when you are logged in, and who can decrypt what it stores. These questions apply to every AI harness, not just ZCode. Users should audit any closed-source tool wrapping an open model.