ZCode, the GLM‑powered coding agent from Z.ai, is quietly turning every developer’s workstation into a data‑exfiltration pipe. As soon as you sign in, the desktop app snapshots the complete workspace—including the full .git directory, LFS caches, reflogs, and global configs—encrypts the archive, and POSTs it directly to Aliyun Object Storage Service (OSS). The encryption uses AES‑256‑CTR for the payload and RSA‑OAEP to wrap a symmetric key; the corresponding private key lives exclusively on Z.ai’s cloud servers, leaving users unable to decrypt their own data【1†L1-L4】. For a typical 42 k‑file project this yields a 313 MB ciphertext built from a 345 MB workspace, where the .git directory alone accounts for 86.6 % of the payload (196 MB LFS + 102 MB objects)【1†L5-L7】. The upload pipeline is triggered before every prompt and on task completion, producing dozens of capture events per session【1†L8-L9】.
The reality is worse than a simple telemetry leak. A Git object store is not a snapshot of your current files; it is the complete lineage of the repository since day one. Deleted API keys, unpushed branch names that reveal unreleased product plans, internal hostnames from .git/config, and even discarded experiment branches are all preserved in the packed archive【1†L10-L12】. ZCode’s privacy policy mentions only “text, files, and code submitted during conversations,” with no reference to full‑workspace snapshotting or git‑history exfiltration【1†L13-L14】.
UI toggles such as “Optimize Experience” and “Repo Snapshot Indexing” only affect model‑training consent and server‑side indexing; they do not gate the host‑level sidecar that performs the packaging and upload【1†L15-L16】. Consequently, the only reliable mitigation is to render the checkpoint directory immutable at the kernel level (e.g., sudo chattr +i ~/.zcode/v2/checkpoints on Linux)【1†L17-L18】—a step that disables the checkpoint‑rollback feature but leaves chat, autocomplete, and tool calls functional.
For SaaS operators, IT directors, and senior engineers, the pain point is concrete and costly. Any secret that ever touched a commit—whether a production key, a credential tucked into a test branch, or an internal hostname—becomes readable by Z.ai the moment it is uploaded. Because the ciphertext resides on the user’s disk but cannot be opened without Z.ai’s private key, traditional data‑loss‑prevention (DLP) tools see only an opaque blob and cannot inspect or block the content. This creates a blind spot for compliance regimes like GDPR, HIPAA, or SOC 2, where the ability to prove that personal or regulated data never left the environment is essential.
The financial impact of a breach could include remediation, regulatory fines, and reputational damage, especially if the uploaded history contains unreleased product roadmaps or third‑party IP. Moreover, the situation underscores a deeper trust issue: running open‑weight models locally does not guarantee locality when the surrounding harness phones home with privileged access【1†L19-L21】.
Failure modes extend beyond the obvious confidentiality risk. The encryption design means that even if you detect the upload, you cannot verify what was sent without relying on Z.ai’s goodwill—a classic “trust‑but‑verify” inversion. Persistent connections to zcode.z.ai and two Aliyun OSS nodes were observed during testing, indicating a ready channel for repeated exfiltration【1†L22-L23】. Should Z.ai’s key management be compromised, all previously uploaded archives become instantly decryptable by attackers.
The lack of any mention of this behavior in the privacy policy or changelog means enterprises cannot rely on vendor disclosures to inform risk assessments【1†L24-L25】. Finally, the workaround of locking the checkpoint directory breaks the advertised rewind feature, forcing teams to choose between functionality and security—a Hobson’s choice that should not exist in a professional‑grade tool.
The blueprint for mitigation is straightforward, though it requires operational discipline. First, treat ZCode as an untrusted network endpoint: enforce egress firewall rules that block outbound traffic to zcode.z.ai and Aliyun OSS endpoints unless explicitly required for other services. Second, implement host‑based integrity controls that make the ~/.zcode/v2/checkpoints directory immutable (Linux chattr +i, macOS chflags uchg) and monitor for attempts to modify those attributes. Third, supplement technical controls with policy: update acceptable‑use prohibitions to forbid the use of any AI coding agent that performs undisclosed full‑workspace snapshotting, and require vendors to provide a clear, opt‑out‑free data‑handling disclosure before deployment.
Fourth, consider switching to fully open‑source agents whose tool surfaces and telemetry are auditable (e.g., repositories listed on Tokenstead or similar trackers). Finally, conduct a data‑inventory sweep: rotate any secrets that have ever been committed to a repository accessed while ZCode was active, and audit branch names for leaked product identifiers.
In short, ZCode’s silent git‑history upload transforms a seemingly helpful coding assistant into a clandestine exfiltration vector that threatens the very premise of local‑only AI. The technical details are clear, the regulatory risk is non‑trivial, and the only effective defense is to treat the tool as hostile and lock down its sidecar at the OS level. Until Z.ai provides transparent opt‑out controls or open‑sources the harness, the prudent move for any security‑conscious organization is to treat ZCode as a data‑leak incident waiting to happen—and act accordingly.
