Zhipu AI's ZCode App Found Silently Uploading Full Git Histories to Cloud

A technical analysis revealed that ZCode, an AI coding desktop app developed by Zhipu AI's GLM team, silently packages and uploads users' entire workspace Git histories, reflogs, LFS caches, and global configs to Aliyun OSS whenever a user logs in. This poses a severe security and privacy risk, as local Git histories and reflogs often contain sensitive uncommitted work, secret API keys, or proprietary source code. It underscores growing cybersecurity concerns over silent exfiltration of local user data by AI developer applications. The application automatically encrypts workspace contents—including hidden `.git` directories and Git Large File Storage (LFS) asset caches—before transmitting them directly to Alibaba Cloud Object Storage Service (Aliyun OSS). The exfiltration process runs silently in the background without user consent or notification.