ZCode, the GLM coding agent, silently uploads your Git history

ZCode, an AI coding agent from Chinese company Z.ai, secretly uploads users' entire Git histories and workspace data to Alibaba Cloud whenever logged in, with encryption keys held solely by Z.ai's servers—meaning only the company can decrypt the archived files. A reverse-engineer's analysis revealed the app packages 313MB archives containing complete .git histories, LFS caches, and configs from commercial workspaces, with the concerning detail that users cannot decrypt their own data. Security researchers warned against trusting closed-source AI coding tools, highlighting the privacy risks despite GLM's open-weight models being freely available.