ZCode uploaded whole Git histories; Zhipu apologizes

ZCode, the desktop coding tool from Chinese AI company Zhipu, packaged developers' entire workspaces and uploaded them to cloud storage, according to an analysis published on September 18, 2026. Zhipu apologized the same day and said the uploads came from a feature that was on by default. The uploads included complete Git histories, which is where deleted credentials and abandoned branches live.

ZCode is an agentic development tool built around Zhipu's GLM models. Tech AI Wire covered the company's GLM-5.3 open-weight release in August 2026.

What the analysis found

The technical write-up by ferstar says the tool archives the working directory while a user is signed in. The archive covered the full .git directory, the large-file cache, reflogs, and global application configuration.

The numbers explain why this matters. One commercial project snapshot reached 313MB across 42,411 files, and 86.6% of that came from .git alone. A Git history is not just the current code. It holds every version of every file, including the API key someone committed and removed three years ago.

Two settings in the interface, labeled "Optimize Experience" and "Repo Snapshot Indexing," did not stop the behavior when switched off, according to the analysis. Deleting a snapshot did not help either, because the tool made a new one. The author's workaround was to make the checkpoint directory unwritable at the filesystem level.

The encryption detail

The archive on disk is encrypted, which sounds reassuring until you look at who holds the key. The analysis says the RSA public key arrives from the server at capture time, while the matching private key stays in the cloud. A developer therefore cannot open the file sitting on their own laptop.

"A key that only the server can use serves exactly one purpose: making sure the server can read your code whenever it wants," ferstar wrote. The write-up also notes that the published privacy policy describes collecting code and text for inference, and says nothing about packaging whole workspaces.

Zhipu's response

Zhipu said it had completed an internal review and apologized to affected users, PANews reported. The company attributed the behavior to a repository indexing feature. That feature supports session recovery, version rollback, and a Repo Wiki function. Zhipu said the Wiki generation step could trigger an upload.

Zhipu's commitment	Detail
Data retention	Uploaded data is destroyed after a Wiki page is generated, not stored
Default setting	The feature was enabled by default during the early launch phase
Code	The ZCode codebase will be open-sourced
Audit	Third-party evaluators will be invited to review how the system behaves
Compensation	Every user receives an extra weekly quota reset

The accounts do not fully agree, and that gap is the story. The analysis describes capture and upload tied to being logged in, with toggles that did not stop it. Zhipu describes a narrower path tied to generating a Wiki page, with the data deleted afterwards. Only the promised third-party audit can settle which description matches the shipped binary.

What this means for developers

Treat your repository as the sensitive asset, not just your current files. Run git log -p against your own history and see what a full copy would expose. Old .env files, internal hostnames, a database dump added and reverted, branch names that name an unannounced product: all of it is in there. That is what a workspace archive contains.

Check what your tools upload before you check what they promise. Network inspection and a look at the tool's own cache directory answer the question faster than a privacy policy does. If a setting claims to disable telemetry, verify it with traffic, because that claim failed here.

For regulated or client code, prefer tools whose capture path you can inspect or disable at the filesystem level. Making a checkpoint directory read-only is a crude control, but it is one you can verify. An open-source release, which Zhipu has now promised, is the version of this claim that anyone can check.