A Coding Assistant Was Quietly Uploading Whole Projects, Including Git History

A developer going by Ferstar pulled apart ZCode, the coding assistant from Chinese lab Z.ai, and found it doing something nobody had agreed to. On login, the app packaged up the user’s entire working folder, including the full .git history, the large file cache, reflogs and global application settings, encrypted the bundle and uploaded it to Alibaba cloud storage. The examined install produced a 313 MB archive covering 42,411 files, of which Git objects made up 86.6 percent, and logged 564 failed attempts to push it up. The feature was on by default with no way to switch it off.

The encryption is the part security people find most uncomfortable. The matching private key sits only in Z.ai’s cloud, so the 313 MB blob on the user’s own disk cannot be opened by the user, or by the ZCode client itself. If you want to know what left your machine, you have to ask the company that took it. Z.ai attributed the behaviour to a “codebase indexing” feature that was enabled by default, apologised, said it had fixed the consent problem and stated that uploaded data has been destroyed. On Monday it went further and released ZCode’s desktop, web and command line code under the Apache 2.0 licence so that developers can audit the client for themselves.

What is behind this

Indexing your code is a genuinely useful thing for an assistant to do. If a tool has read your project, it can answer questions about your project rather than about programming in general, and every serious coding assistant does some version of this. The failure here was not the idea, it was three choices stacked on top of each other: no consent prompt, no off switch, and a scope far wider than the job required. Git history is not source code you are currently working on. It is every change anyone ever made, often including secrets that were committed by accident years ago and removed from the current files but never from the history. That is exactly the material you would least like to hand to a third party by surprise.

Open-sourcing the client is a real remediation and also a limited one. It lets anyone verify what the program sends from now on. It cannot verify what a server already received, or whether it was deleted, which is why the company’s word remains the only evidence on that point.

What this means for you: Worth doing today if you use any AI coding tool, free or paid: find its settings and look for anything described as indexing, workspace sync, or telemetry, and decide deliberately rather than by default. Treat Git history as sensitive, because it is. And if a tool offers no way to turn a data feature off, that absence is itself the answer about how the vendor thinks. None of this is a China-specific problem, it is a default-settings problem, and the same audit is worth running on tools from anywhere.

Sources

• Tom’s Hardware: Devs say Chinese AI company silently uploaded hundreds of megabytes of local workspace data
• Ferstar: Inside ZCode, silently uploading your entire Git history to the cloud
• The Standard: Z.AI open-sources ZCode after coding tool uploads local data silently