ZCode uploaded users' Git histories. The off switch did nothing

Late last week, a developer who posts as @ferstar_org tagged Z.ai, the Beijing company behind the GLM models, with a blunt question. Why does its coding app, ZCode, pack up entire workspaces plus their full Git history and upload them to Alibaba Cloud storage on login? The post listed three problems: the "server holds the only decryption key," no setting in the app actually turned it off, and the privacy policy didn't mention it. It has been viewed more than 1.6 million times.

On Sunday night, the company's official account, @zcode_ai, posted its answer. It apologized, said the fix is done, and open-sourced the entire app on GitHub. That's a fast and fairly thorough response. It doesn't answer the question every business using AI tools should be asking, though: how would you know if one of yours did the same thing?

What the forensics found

Ferstar's write-up is detailed. On one machine, ZCode had bundled a commercial project into a 313MB encrypted archive: 42,411 files, with 86.6% of the weight coming from the .git folder. The app captured snapshots whenever the user was logged in, before prompts, and when tasks finished, up to 62 capture events in a single session.

Two settings looked like they should stop this, "Optimize Experience" and "Repo Snapshot Indexing." Switching them off didn't. The encryption was built so that Z.ai's servers hand the app a public key and keep the private one, which meant the user couldn't open the archive sitting on their own disk.

One detail cuts in Z.ai's favor. That 313MB upload failed 564 times and never went through. A small archive of a public repo, about 15KB, did reach the servers.

What Z.ai says now

According to @TechBuzzChina, the company apologized on September 18, blamed a feature called Repo Wiki, and said uploads were destroyed after the wiki was generated. Affected users got a weekly quota reset.

The longer statement from @zcode_ai goes further. Version 3.14.0 of the app removes Repo Wiki and the snapshot workflow. Z.ai says two outside assessors, the government-affiliated CAICT and the security company NSFOCUS, confirmed the storage bucket was emptied and then deleted. It says the code data isn't retained and has "never been used for model training," and it's starting a paid program for bug reports. The full assessment report is due "soon."

Why the Git history is the part to worry about

A Git history holds every version of a project, including the ones people tried to erase. Say someone on your team pasted a password, an API key, or a customer file into a repo and deleted it the next day. The history still has it. Uploading the current folder is bad enough. Uploading the history can hand over secrets nobody remembers are still in there.

Open-sourcing the app helps, since anyone can now read what the client does. But as Runtime Wire points out, public client code can't prove what happens on the server, who holds the keys, or how complete the cleanup was. You're still taking the company's word, now with two auditors attached.

My read is that a product team wanted a feature that needed your whole repo and didn't bother to ask. I've seen nothing that points to spying. That kind of overreach is a risk with every vendor, Chinese or not, which is why it's worth taking seriously.

What it means for businesses using AI tools

AI coding apps and desktop agents are useful because they can read your files. That same access is what made this possible. The ZCode case also shows that a toggle labeled "off" only tells you what the vendor says will happen.

If your team runs AI tools on machines that hold client work, a few habits help:

• Point each tool at one project folder, not a home directory or a whole drive.
• Keep secrets out of repos in the first place, and scan old history for any that slipped in.
• Read what the vendor says it collects, and assume the defaults are on.
• For anything sensitive, check outbound network traffic once instead of trusting a settings page.

When New Face Design wires AI into a client's workflow, we limit what it can see and check what leaves the building before it touches real data. If you want to know where AI already has access in your business, our free process audit is a good place to start.

Z.ai moved quickly once it got caught. What should bother everyone else is who did the catching: an outside developer who took the app apart.