Z.ai's ZCode uploads full Git histories without a working opt-out, researchers find
Reverse engineering found encrypted workspace snapshots sent to Aliyun OSS whenever a developer uses the logged-in desktop app.
By Ryan Merket · Published
Primary source: X - J. F. Zhang
Why it matters
Coding agents receive broad filesystem access. Undisclosed full-repository snapshots turn that access into a source-code governance risk for developers and employers.
J. F. Zhang (@ferstar_org) reported on September 18th that Z.ai's ZCode desktop app packages developers' workspaces, including complete Git histories, and uploads the encrypted snapshots to Alibaba Cloud's Object Storage Service without a working user opt-out.…
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.