ZCode Found Uploading Entire Repos Including .git History to Alibaba Cloud
jedisct1 · x · 2026-09-18
A developer reverse-engineered Zhipu's (Z.ai) ZCode desktop client and found a serious privacy issue:
- While logged in, the client packages the user's entire repo — including full .git history — encrypts it so only the server can decrypt, and uploads it to Alibaba Cloud storage
- Privacy toggles did not stop the uploads
- Z.ai says it came from its Repo Wiki indexer, the data was deleted after use, and it's now fixed
The poster warns Mac users to hold off and quips there's no free lunch: with all that collected code, hopefully open-source AGI comes out of it soon.
More from coding & agent
- NIST publishes design tenets for agent identity management with crypto-verifiable identities — AccBalanced · 2026-11-04
- MCP's most underrated use: running your social media accounts from a chat — heyshrutimishra · 2026-11-04
- LadybugDB: an embedded graph database with Cypher, columnar execution and vector indexes, 1.9k stars — JeremyCMorgan · 2026-11-04
- Dev hits multi-credential pitfall in NewMax Provider: one key per provider doesn't scale — yangyi · 2026-11-04
- WIP 'DiffusionGearvis' Project Uses DiffusionGemma to Speed Up and Privatize Computer-Use Agents — qberthet · 2026-11-04
- Musk cites unsustainable Grok Bot costs as Hermes offers one-command agent migration — Teknium · 2026-11-04