ZCode AI Programming Tool Found to Upload Entire Git Repositories to Alibaba Cloud

Dynamic Insight Beating AI News: It has been revealed that ZCode, a programming tool developed by Zhipu AI, secretly creates snapshots of entire projects in the background, packaging and encrypting the entire .git directory before uploading it to Alibaba Cloud OSS. After reverse-engineering the client, tech blogger ferstar found that this mechanism runs as long as the user is logged in, with no toggle available in the interface to disable uploads. One commercial project snapshot he discovered was approximately 313 MB, containing 42,000 files—86.6% of which were from the .git folder, including Git history objects, LFS large file caches, and reflog entries. This means the snapshot includes not only the current code but also past commits, previously downloaded large files, and local branch operations. The snapshot failed to upload 564 times and remained locally pending retries. ZCode’s official privacy policy currently only states that it collects text, files, and code “submitted during conversations,” without explicitly mentioning entire repositories or Git history. Although ZCode’s “Optimization Plan” is disabled by default, it only controls whether data is used for model training; ferstar confirmed that disabling this option does not stop the snapshot packaging or uploading process.