Wait, My Coding History Is Secretly Being Sent to the Cloud? The Controversy Surrounding ZCode's Covert Data Leaks

Imagine this: All the revision history of a project you spent months working nights on, your past mistakes, and sensitive configuration information that might have accidentally slipped into the code are being transmitted to someone else’s server without your knowledge. How would that make you feel? Recently, this exact terrifying suspicion was raised among developers using the AI coding tool “ZCode.”

ZCode is an official desktop AI coding agent built by Z.AI based on the GLM model [Source 4, Source 5]. The news that this tool, which had been gaining attention for its convenient features, has been secretly transmitting user data is sending shockwaves through the developer community.

Why does this matter?

You might think, “It’s just sharing a bit of my code, what’s the big deal?” But for developers, Git (a system that manages code change history) history is more than just files. It can contain not only the entire structure of the project but also accidentally included passwords, access tokens (authentication info), personal development habits, and even internal corporate secrets.

Transmitting such sensitive data to an external server without explicit user consent is a very serious security threat. In particular, this allegation suggests that even the “data transmission prevention” toggle provided in the UI might not be working properly, fundamentally shaking developers’ trust [Source 14].

Putting it simply

To use a simple analogy, imagine you installed a “Smart AI Diary App” to help you write a diary. The app helps you write. But while you’re writing, the app secretly copies the “old diary” hidden behind the current one and the “scraps of notes” you already tore up and throws them into someone else’s warehouse.

Forensic reviews (the process of analyzing digital information to find evidence) show that ZCode version 3.12.3 generated an encrypted snapshot of a massive 748 MiB. Shockingly, 98.9% of this data was Git-related information [Source 17]. In other words, it wasn’t just grabbing the parts needed for coding; it was taking the entire footprint of your project wholesale.

What is the current situation?

The biggest problem is ZCode’s attitude. Their official privacy policy only states that they collect “text, files, and code submitted during chats.” There is no mention anywhere of collecting entire project repositories or Git history [Source 16].

According to what has been confirmed so far, ZCode is packaging and encrypting the user’s workspace and uploading it to Alibaba Cloud (Aliyun OSS) [Source 1]. Some users even discovered these abnormal transmission attempts because they were repeatedly getting upload failure messages [Source 16].

What happens next?

This incident has brought the issue of “transparency,” hidden behind the immense convenience that AI development tools bring us, back to the surface. Developers now live in an era where they must carefully examine not only the performance of a tool but also how deeply and how it handles data on their computers (local environments).

We will have to wait and see if Z.AI offers a transparent explanation for this situation and improves its data collection methods, or if many developers will leave to find safer alternatives. When using AI coding tools, it is now a necessary habit to always check data privacy settings and network traffic at least once.

References

1. InsideZCode: Silently Uploading Your Entire Git History to the Cloud

2. [ZCode Docs

   GLM-5.3 Agentic Coding Guide](https://zcode.z.ai/en/docs/welcome)

3. ZCode+GLM5.2 Tutorial - Stop Paying $200 for Claude Code
4. ZCode Explained: Z.ai’s Agentic Dev Environment for GLM-5.2
5. ZCode+GLM5.3: The Complete Guide to Z.AI’s Coding Agent
6. Zcode Review 2026: Free AI Coding Agent With Goal Mode (vs Cursor)
7. GitHub - nothing1595/codex-zcode-bridge

8. [ZCode

   Official Harness for GLM-5.3](https://zcode.z.ai/en)

9. [GLM5.2 бесплатно и БЕЗЛИМИТНО за 5 минут

   Без карты в Zcode](https://www.youtube.com/watch?v=J3-lDiB-U8g)

10. Claude Code vs Cursor vs ZCode: что выбрать в августе 2026
11. Революционный ZCode 3.0 — альтернатива Claude Code…
12. What is GLM and how it can help you be more productive

13. [OpenCode

    The open source AI coding agent](https://opencode.ai/)

14. ZCode uploads your git history; Z.ai holds the only key
15. ZCode, the GLM coding agent, silently uploads your Git history
16. ZCode AI Programming Tool Found to Upload Entire Git Repositories to Alibaba Cloud
17. Developers Asked Where ZCode Was Sending Their Git History

18. [ZCode: what Z.ai’s GLM-5.2 coding agent really is

    eesel AI](https://www.eesel.ai/blog/zcode)

19. Z.ai launches ZCode to turn GLM-5.2 into a coding-agent wedge