Inside ZCode: Silently uploading your Git history to the cloud
ZCode, a popular AI coding app, has been caught red-handed silently archiving and uploading users' complete Git histories and workspace data to Aliyun OSS, secured by encryption keys held exclusively by the vendor. This clandestine data exfiltration, sans disclosure or opt-out options, has ignited a fiery debate on developer privacy, intellectual property security, and the inherent trust (or lack thereof) in closed-source AI agents. HN commenters are up in arms, comparing it to past AI tool scandals and advocating for sandboxing, open-source harnesses, and a healthy dose of paranoia when dealing with powerful, opaque software.
The Lowdown
ZCode, an AI coding desktop app by Zhipu, has been exposed for covertly uploading users' entire development workspaces, including sensitive Git history and LFS assets, to its cloud servers. This discovery, made by a developer investigating unusual disk usage, reveals a significant breach of user privacy and intellectual property.
- A developer discovered
~/.zcodeconsuming hundreds of megabytes, prompting an investigation into its purpose. - The app packages full Git histories (objects, LFS cache, reflogs), configuration files, and source code, then encrypts and uploads them directly to Aliyun OSS.
- Crucially, the encryption key for this uploaded data is server-generated and server-held, meaning only Zhipu can decrypt the user's data; neither the user nor the local client can access it.
- The
.gitdirectory alone accounts for 86.6% of the payload, containing potentially sensitive information like historical API keys, unpushed feature plans, and internal network configurations. - Despite UI options like "Optimize Experience" or "Repo Snapshot Indexing," these toggles do not disable the background upload; the process runs unconditionally as long as the user is logged in.
- ZCode's privacy policy contains no mention of this extensive and silent data collection.
- The only effective defense identified is setting a filesystem-level immutability flag (e.g.,
chflags uchgon macOS,chattr +ion Linux) on the~/.zcode/v2/checkpointsdirectory.
The author concludes that this behavior transcends simple inference context provision, representing an architectural design for data collection rather than user-centric backup or synchronization, raising critical questions about the implicit trust placed in modern AI development tools.
The Gossip
Deja Vu and Data Grab Durability
Many commenters expressed a sense of 'been there, done that,' recalling previous incidents where AI coding tools were caught performing similar data exfiltration (e.g., Grok Code saga). There's a pervasive cynicism that this behavior is becoming normalized among AI companies, with some users resigned to it as an inevitable cost of using such tools, while others vehemently denounce it as malware and a betrayal of trust.
Closed Source vs. Open Source Agents: A Trust Tussle
A significant portion of the discussion centered on the risks associated with closed-source AI agents versus the perceived (though not always flawless) trustworthiness of open-source alternatives. Many users declared closed-source agents a "red flag" and advocated strongly for open-source harnesses, highlighting the transparency benefits and the potential for community oversight to catch malicious practices. However, some also noted that even open-source tools have had their own data-handling gaffes, emphasizing the need for vigilance regardless of licensing model.
Sandboxing and Scrutiny for System Security
Given the perceived untrustworthiness of AI agents, many commenters discussed the practical necessity of implementing robust security measures like sandboxing, virtual machines, or dedicated user accounts to isolate AI tools and limit their access to sensitive files. A debate ensued regarding whether this burden should fall on the user to create zero-trust environments or if companies should be inherently transparent and trustworthy in their data practices.
Zhipu's Apology and Geopolitical Grumbles
Zhipu (Z.ai) issued a public apology, attributing the issue to a "codebase indexing" feature meant for "session checkpoint restoration" and promising to open-source the ZCode codebase soon, along with a compensatory quota reset. Commenters reacted with a mix of skepticism and further concerns, with some linking the incident to broader geopolitical issues and data practices of Chinese companies. One self-identified Chinese user offered a stark perspective on corporate deregulation and data privacy in China, highlighting the country's 'crazily new world' where companies often operate without stringent oversight.