Inside ZCode: Silently uploading your Git history to the cloud

ZCode, Zhipu's AI coding desktop app, silently uploads users' entire Git repositories—including commit history, large file caches, and configuration files—to Aliyun cloud storage whenever they are logged in. The encryption uses an RSA public key delivered by the server, with the private key stored only in the cloud, meaning users cannot decrypt the hundreds of megabytes of data sitting on their own disk. One investigator discovered a 313MB encrypted archive of their commercial project with 564 failed upload attempts pending on their system.