Zhipu's ZCode accused of silently uploading full workspace git history to Aliyun OSS
menhguin · x · 2026-09-18
- Blogger ferstar reverse-engineered traffic while cleaning /.zcode and found that Zhipu's ZCode, after login, quietly snapshots the entire workspace — including full .git history, LFS files, and reflog — encrypts it, and uploads it to Aliyun OSS.
- Claims: the decryption key lives only server-side, uploads can't be disabled in settings, and the privacy policy doesn't disclose this. Developers report they are close to reproducing it locally.
- The post advises developers to stop using ZCode pending community verification and an official response.
More from coding & agent
- NIST publishes design tenets for agent identity management with crypto-verifiable identities — AccBalanced · 2026-11-04
- MCP's most underrated use: running your social media accounts from a chat — heyshrutimishra · 2026-11-04
- LadybugDB: an embedded graph database with Cypher, columnar execution and vector indexes, 1.9k stars — JeremyCMorgan · 2026-11-04
- Dev hits multi-credential pitfall in NewMax Provider: one key per provider doesn't scale — yangyi · 2026-11-04
- WIP 'DiffusionGearvis' Project Uses DiffusionGemma to Speed Up and Privatize Computer-Use Agents — qberthet · 2026-11-04
- Musk cites unsustainable Grok Bot costs as Hermes offers one-command agent migration — Teknium · 2026-11-04