AnalysisDevelopersSeptember 18, 2026

ZCode coding agent silently uploads Git history to Aliyun OSS

A reverse-engineering walkthrough found Z.ai's ZCode desktop app packages the entire workspace — .git history, LFS cache, reflogs, global configs — into a 313MB encrypted archive from a 345MB workspace (42,411 files) and uploads it to Alibaba Cloud object storage. The encryption key is wrapped with an RSA-OAEP public key delivered by the server during upload-credential negotiation.

1 source

More stories today

Open the live feed