ZCode uploaded the entire Git history — what AI coding tools send to the cloud

1. Executive summary

First, some definitions. Z.ai is the international brand of Zhipu (智谱), an AI company based in Beijing, China, and it makes the GLM model series. ZCode is a free desktop coding agent app the company announced in June 2026; it runs on macOS, Windows and Linux [8]. In this report, a snapshot is a single compressed file into which the app bundles the entire workspace (the project folder). Envelope encryption locks a file with a one-time symmetric key, locks that symmetric key again with a public key, and sends both together. Only the holder of the matching private key can unlock it.

The figures in this report are exactly as stated in the investigation [1] and the GitHub audit repositories [4][5]. The vendor statement is taken from the full text as carried by Chinese media [2][3]. We did no measurements of our own.

2. What happened — from the June launch to September 18

One more piece of context. This is the second time this year that hidden behavior in a coding agent has come to light after the fact. On June 30, an analysis of Claude Code version 2.1.196 found code that carried the user's time zone and proxy host information inside the date sentence of the system prompt, encoded as invisible apostrophe variants [10]. An Anthropic engineer replied that it was "an experiment we launched in March" to prevent unauthorized resale and distillation, and it was removed in the July 1 release (according to secondary reporting [11]). What the two incidents have in common: behavior missing from the documentation came to light only after someone reverse-engineered the binary. We collected incidents that actually happened with coding agents, and the defenses that do not work, in Coding agent security 2026.

3. What the investigation found — the flow, the contents, the switches, the key

The investigator started after noticing that the ~/.zcode folder had grown past 700MB. Inside v2/checkpoints/ were a 313MB .enc file and a state file. The state file recorded the path of a commercial project, a workspace of 345,549,173 bytes, 313,070,842 bytes after encryption, the kind baseline (a full snapshot), and a failure count of 564 [1]. The upload had failed 564 times and the file had stayed in pending/, which is how it was found. The logs did not contain the upload address, so the investigator unpacked the app package (app.asar) and reconstructed the flow.

The upload flow

What was in the snapshot

The ciphertext cannot be opened, but the file list (manifest) created during bundling was left in plaintext. This is the breakdown of the 42,411 files [1].

The .git directory makes up 86.6% of the total snapshot size. This is different from "sending code" because it includes things that are not in the current working tree: secrets such as API keys and tokens, and settings, that were deleted in later commits; the names of branches that were never made public; and the internal GitLab host names and paths in .git/config. On top of that, an extra list holding hashes of global settings files such as settings.behavior.json was bundled into every snapshot [1]. .gitignore does not help, because the target is not ignored files but .git itself.

What the two switches actually do

According to the investigation, the background capture-and-upload component, which the code calls a sidecar, is created unconditionally when the app starts. No code path checks the user's settings; the only condition was whether a valid login token (JWT) could be obtained [1]. Captures happened right before every prompt was sent (captureBeforePrompt) and when a task labeled repo-wiki-update finished, and up to 62 were recorded in one session.

4. Where the vendor's answer and the findings disagree

Z.ai's apology appeared in its official user group on September 18, and Chinese outlets including Sina Tech and Tencent News carried the full text [2][3]. It makes five points.

• The problem came from the "codebase indexing" feature. This feature builds an index locally to support restoring session checkpoints, rolling back to earlier versions, and Repo Wiki (repository knowledge pages).
• A repository data upload can happen when Repo Wiki pages are generated.
• Once the wiki has been generated in the cloud, the uploaded data is destroyed immediately and is not stored.
• The feature was on by default in the early days after launch, so some users were affected.
• It has already been fixed; the code will be released, a third party will assess it, and progress will be made public.

The table below sets each claim in the statement (our translation from the Chinese) beside what the investigation and audits found.

In fairness, a few things should be noted. The statement came out on the day of the incident, named the feature responsible, and made verifiable commitments: releasing the code and a third-party review. Whether those commitments are kept is the next thing to check in this incident. However, the apology was posted only in a user group, so this report relies on the full text as carried by Chinese media. We could not find an official English post as of 2026-09-19.

5. Two independent audits — what is confirmed and what cannot be

The investigation records a single installation. That makes it important whether the same behavior reproduces on other machines. Among the audit repositories posted to GitHub after September 18, we looked at two that assign evidence grades and include reproduction scripts.

The two audits agree on the capture scope (.git included), the encryption method, the destination, and the fact that the switches do not stop the upload. The investigation's core claims match across three machines. Where they differ is whether the upload actually completed. One audit found completion records; the other wrote that it could not tell on its own machine. On the investigator's machine, the file was still pending after 564 failures. In short, "it bundles your workspace and tries to upload it" is established, while "how much actually went up" varies from machine to machine.

6. What do other tools send? — according to their official documentation

In the Hacker News discussion, many commenters asked whether other tools do the same thing [9]. That question should be answered from documentation, not guesswork. For the table below, we read each tool's official data documentation on 2026-09-19 and recorded the same four things. Anything we could not confirm in the documentation is marked as not in the docs. There is no guarantee that what the documentation says matches actual behavior: ZCode's documentation did not mention snapshots either, and Claude Code's June incident was also undocumented behavior.

How to read the table: any tool sends code when a request gives the model code context. That cannot be avoided. The differences come down to three things. First, scope. The five tools talk about "what you sent in the conversation" and "around the cursor"; ZCode's snapshot was the repository's entire history. Second, defaults. Copilot's individual plans have used data for training by default since April, Claude Code's consumer plans leave it to the user, and all five tools exclude commercial and enterprise plans from training. Third, whether the documentation gives you a switch to turn it off. Among the documents we read, the only items with no way to turn them off are ZCode's snapshots and Copilot's engagement data, and the two are different in kind: the latter is usage metrics, the former is code.

7. Checklist to apply today

The first items are for ZCode users; the rest apply to anyone using a coding agent.

If you use ZCode

• First, look at what was bundled. The state files and file lists (manifests) under ~/.zcode/v2/checkpoints/ are plaintext. They show which projects were captured, when, and how many times. Some repositories have published self-check scripts [4][5].
• To block uploads, lock the folder. The investigator found that if you delete it, the workspace is bundled again within 30 minutes. The investigator's procedure is to delete the folder, recreate it, and lock it. On macOS: rm -rf ~/.zcode/v2/checkpoints && mkdir -p ~/.zcode/v2/checkpoints && chflags uchg ~/.zcode/v2/checkpoints. On Linux, only the last command changes: sudo chattr +i ~/.zcode/v2/checkpoints. If you lock the folder without deleting it first, encrypted files already pending stay there. Checkpoint rollback stops working; chat, autocomplete and tool execution keep working [1]. This is a workaround the investigator confirmed on their own machine. We could not confirm whether it is still needed in the version the vendor says is fixed.
• Rotate every secret that ever entered the repository history. Snapshots include the contents of deleted commits. Treat any API key, token or password that was ever in the .git history as already exposed, and reissue it. Scan the history with git log -p or a secret scanner.
• Logging out stops it. According to the investigation, the sidecar's only condition is a valid login token. Setups that use your own key or a self-hosted model are documented [8]; check that those setups also work without logging in before you use them.

Whatever coding agent you use

• Read the data documentation before installing, and if there is none, treat that as a signal in itself. Do not connect a tool to your team's code if you cannot fill in the four fields from section 6 (path, training default, how to turn it off, retention period).
• Look at the outbound connections yourself at least once. There is no guarantee that behavior matches the documentation. Use lsof -i -P | grep <process> or firewall logs to see what the app connects to. If you see a storage domain other than the model API, find out why.
• Turn off unnecessary traffic in the settings. For Claude Code, that is CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1. For Gemini CLI, privacy.usageStatisticsEnabled: false. For Codex, the analytics flag. For Copilot individual plans, the Privacy section of the settings; for Cursor, Privacy Mode. For a team, put these in a settings file and distribute it.
• Use company code only on commercial or enterprise plans. All six tools exclude commercial and enterprise contracts from training use. Copilot excludes a paid organization's repositories from training even when you open them on an individual plan, but private repositories owned by a personal account can be used for training during active sessions on an individual plan [14]. Which account the company code lives under decides how far the protection reaches.
• Know what .gitignore cannot block. In this incident, 86.6% was .git. Secret values in the history go away only when you reissue them, not through an ignore list.

8. What this is not yet

• We did no measurements of our own. This report cross-checks one investigation, two audit repositories, press reports carrying the vendor statement, and each tool's official documentation. We did not install ZCode and reproduce the behavior ourselves.
• Nobody has verified the server side. "Destroyed immediately" cannot be verified, and neither can training use, retention or access. If the vendor delivers the code release and third-party review it promised, we will revise this report.
• Whether the upload completed varies by machine. One audit found completion records, the other could not tell, and the investigator's machine showed 564 failures. How many users' code was actually uploaded is unknown.
• We could not confirm the fixed version. The statement gives no version number, and the audited version is 3.12.3. How the sidecar changed in later builds is hard to know until the code is released.
• The vendor statement is secondhand. Chinese media relayed a post from a user group. We could not find an official English post, and the wording may differ between outlets.
• Sources disagree on ZCode's launch date. VentureBeat gives an announcement on June 12, while other secondary sources give a launch in early July. This report follows VentureBeat.
• We could not confirm the training policy for Codex used through a ChatGPT plan. The OpenAI help page refused automated requests. We confirmed the policy for use with an API key (no training, 30-day abuse-monitoring logs) from the API documentation, but that documentation does not mention Codex separately [17].
• The same limitation applies to Gemini CLI's personal-account policy. The Code Assist policy page for individuals had been replaced by a service-termination notice dated 2026-06-18, so we could not confirm the current wording. The table lists only the usage-statistics part.
• Copilot's plan list follows the 2026-03-25 blog post and the FAQ (Free, Pro, Pro+). We could not confirm from official documentation whether any individual plans have been added since.
• How Cursor indexes a codebase was not in the documents we read. We recall details such as chunks, embeddings and path obfuscation from earlier documentation, but we could not confirm them, so we left them out.
• We left out the suspicions about other tools raised on Hacker News. They are comment-level claims that no source material or documentation confirms.
• We could not find Korean coverage. As of 2026-09-19, we found no Korean-language media or community posts about this incident.

9. Sources

All checked on 2026-09-19. [1], [4], [5] and [10] are investigation records by independent developers; [6], [7] and [12]–[17] are official documentation from each vendor. [2], [3], [8], [9] and [11] are secondary sources.

Editorial standard: in every table we separated what was confirmed on the client from claims about the server side, and we state that the vendor statement is secondhand. For the other tools, we included only what the official documentation says and marked undocumented items as missing.