ZCode AI coding agent uploads entire Git history to Alibaba Cloud

The closed-source ZCode AI coding agent silently packaged and uploaded a developer's entire local workspace to Alibaba Cloud, with the full .git history accounting for 86.6% of a 42,411-file encrypted payload totaling 345MB, according to an analysis published on tokenstead.ai. The archive is encrypted with a server-provided public key whose private key is held only in Z.ai's cloud, so the user cannot decrypt what was uploaded while Z.ai can, exposing deleted API keys, internal hostnames, and unpushed branches. The report recommends blocking ZCode on networks, auditing developer machines, and rotating every credential that has ever existed in the affected codebases.

Hacker News https://tokenstead.ai/guides/zcode-silent-git-history-upload ZCode AI coding agent uploads entire Git history to Alibaba Cloud Which summary reads better? Pick one — models revealed after.Both summaries are AI-generated. The closed-source ZCode coding agent silently packages and uploads your entire local workspace, with the complete .git history making up over 86 percent of the exfiltrated payload encrypted via keys held solely by Z.ai. This means any developer using this harness has exposed their entire repository lineage, including previously deleted API keys, internal hostnames, and unpushed branches, to a third-party cloud. You must immediately block ZCode on your network, audit developer machines, and rotate every credential that has ever existed in the history of those codebases. ZCode silently archived and uploaded a 345MB workspace including full .git history, reflogs, LFS cache, and configs; in the observed case, .git made up 86.6% of a 42,411-file encrypted payload. The archive is encrypted with a server-provided public key whose private key is only in Z.ai’s cloud, so the client/user cannot decrypt what was uploaded but Z.ai can. Treat closed-source AI coding harnesses as exfiltration-capable by default: full Git history means deleted secrets, unreleased branches, internal paths, and historical code can leave the machine even if the working tree looks safe.