Zhipu's ZCode accused of silently uploading full workspace git history to Aliyun OSS
menhguin · x · 2026-09-18
- Blogger ferstar reverse-engineered traffic while cleaning /.zcode and found that Zhipu's ZCode, after login, quietly snapshots the entire workspace — including full .git history, LFS files, and reflog — encrypts it, and uploads it to Aliyun OSS.
- Claims: the decryption key lives only server-side, uploads can't be disabled in settings, and the privacy policy doesn't disclose this. Developers report they are close to reproducing it locally.
- The post advises developers to stop using ZCode pending community verification and an official response.
Related event: Zhipu's ZCode Reportedly Uploads Entire Workspaces Silently(3 posts)→
More from coding & agent
- Dev builds Jev to auto-remove reply-guy comments on X, now learns from false positives — iannuttall · 2026-09-18
- Developer who abandoned notebooks for agents says Codex made them fun again — intellectronica · 2026-09-18
- ScrapeGraphAI: open-source Python scraper that builds pipelines from plain-English prompts — thisdudelikesAI · 2026-09-18
- ScrapeGraphAI: open-source library that scrapes any site with one plain-English prompt — thisdudelikesAI · 2026-09-18
- rui314: translating an entire C++ codebase to Rust was surprisingly easy with OpenAI Astra — charliermarsh · 2026-09-18
- Tip: Have Your AI Agent Classify PR Merge Risk by Reversibility and Blast Radius — mattpocockuk · 2026-09-18