Z.ai's ZCode quietly uploads your repo and full .git history
The GLM maker's coding client ships your whole workspace to Aliyun OSS, and the opt-out toggles do nothing. Plus: OpenAI's monorepo breached via one image.
Copy markdown
Your whole workspace, shipped out silently
A researcher reverse-engineered ZCode, Zhipu/Z.ai's official AI coding desktop app, and found it packages your entire workspace — full .git history, LFS cache, reflogs, and global configs — then uploads it encrypted to Aliyun OSS. One snapshot: 42,411 files, ~345MB, nearly 90% of it your Git data. If you've run it signed in, your private repo history may already be sitting in their cloud.
The privacy toggles are theater
The "Optimize Experience" and "Repo Snapshot Indexing" switches only gate server-side training and indexing — neither stops the capture or the upload. And you can't read your own archive back: the server hands over an RSA public key on the fly while the private key never leaves Z.ai's cloud. The only real opt-out is not running the app while logged in.
Check whether you were hit — and Z.ai's response
A forensic agent skill (zcode-upload-forensics on GitHub) inspects your machine and returns a confidence-rated verdict plus a single-file HTML evidence report on whether ZCode uploaded your workspaces — worth running this weekend if you ever installed it. Z.ai has reportedly said it will open-source ZCode following the findings.
Elsewhere: OpenAI's internal monorepo reached via one image
Researchers chained a libheif heap overflow in community.openai.com's HEIC upload path with an SSO misconfiguration to hijack an employee's Codex account and open a pull request inside OpenAI's private monorepo. OpenAI patched the SSO flaw in ~14 hours and paid a $6,500 bounty; the writeup surfaced this week. A reminder that image pipelines and SSO scope are live attack surface.