ZCode Uploads Users' Full Git History, Zhipu Says It Deletes It

What ferstar found in ZCode's traffic

A developer using the handle ferstar reverse-engineered ZCode, the desktop coding assistant Zhipu builds around its GLM models, and published the results on Sept. 18 in a post titled "Inside ZCode: Silently Uploading Your Entire Git History to the Cloud." Once a user logs in, ferstar wrote, ZCode packages the entire workspace, including the complete .git history, LFS asset cache, reflogs and global app configuration, and uploads it to Aliyun OSS, Alibaba Cloud's object storage service, with no notice to the user.

One test snapshot ferstar captured held 42,411 files totaling 313 megabytes compressed, up from 345 megabytes uncompressed. Git data made up 86.6 percent of that payload, split between the LFS cache and commit objects.

Component	Size	Share of payload
.git/lfs	196.1 MB	56.8%
.git/objects	102.2 MB	29.6%
Source code and docs	46.2 MB	13.4%
.git/logs	0.6 MB	0.2%

Zhipu's own privacy policy, FAQ and changelog mention only "text, files, and code submitted during conversations," ferstar wrote, with no line covering a full workspace or Git history upload. KuCoin News independently confirmed the file count and the 86.6 percent Git share the same day.

Why users can't just check what was sent

The upload is encrypted twice over: workspace data is compressed and locked with an ephemeral AES-256-CTR key, and that key is then wrapped in RSA-OAEP-SHA256 using a public key ZCode's server hands over at upload time. Zhipu's backend holds the only matching private key. That means the 313 megabytes of ciphertext ferstar found sitting on their own drive was not something they, or any ZCode user, could open.

The design that alarmed ferstar is the same design that now makes Zhipu's cleanup promise impossible for a user to verify. Because only Zhipu holds the decryption key, nobody outside the company can confirm a given snapshot was deleted rather than merely marked for deletion.

What Zhipu said, and what it left out

Zhipu apologized the same day, saying the uploads came from a "code repository indexing" feature tied to ZCode's Repo Wiki tool, which generates documentation pages in the cloud, according to PANews. The company said the feature was "enabled by default in its early launch phase" and that uploaded data "is immediately destroyed and not saved" once a Wiki page finishes generating.

Zhipu did not say how long the feature had shipped enabled by default before ferstar's post, and it did not explain why generating a Wiki page required uploading reflogs and the full LFS cache rather than the source files a documentation tool would need to read. The company said it will open-source ZCode's codebase, invite third-party evaluators to review its systems, and issue every ZCode user an extra weekly usage quota starting the day of the apology.

The pattern this joins

ZCode is not the first coding agent in 2026 to ship a data-handling surprise past its own documentation. Tencent's BrowserSkill shipped a gap that let a command-line flag skip the human confirmation step before an agent could act inside a user's logged-in browser, and Cloudflare's own audit skill for coding agents was built specifically to catch the kind of behavior a codebase's authors did not flag themselves. In each case, the tooling meant to make agentic coding safer shipped a step behind the access it was already granted.

Zhipu has not published a timeline for the promised open-sourcing or named the third-party evaluators it says it will invite.