Zhipu's ZCode accused of encrypting and uploading users' workspaces and Git history, with keys held only on its servers
yangyi · x · 2026-09-18
A developer on X discovered that Zhipu's AI coding tool ZCode packages, encrypts and uploads users' workspaces to Alibaba Cloud OSS — including not just current code but the entire Git history since repo creation. Others reproduced the behavior on Windows, so it's not a macOS-only issue.
The key concern: the decryption private key exists only on Zhipu's servers, meaning users cannot open the encrypted bundles themselves — their local repo history is uploaded without their knowledge and can't be turned off. Multiple users report company code has leaked as a result. The original poster sarcastically defends "NewMax" as uploading nothing. Allegations remain officially unconfirmed.
More from coding & agent
- NIST publishes design tenets for agent identity management with crypto-verifiable identities — AccBalanced · 2026-11-04
- MCP's most underrated use: running your social media accounts from a chat — heyshrutimishra · 2026-11-04
- LadybugDB: an embedded graph database with Cypher, columnar execution and vector indexes, 1.9k stars — JeremyCMorgan · 2026-11-04
- Dev hits multi-credential pitfall in NewMax Provider: one key per provider doesn't scale — yangyi · 2026-11-04
- WIP 'DiffusionGearvis' Project Uses DiffusionGemma to Speed Up and Privatize Computer-Use Agents — qberthet · 2026-11-04
- Musk cites unsustainable Grok Bot costs as Hermes offers one-command agent migration — Teknium · 2026-11-04