Aliyun Oss - GoKawiil

Z.ai's ZCode desktop app secretly uploads users' full Git history to Alibaba Cloud

A reverse-engineering report by developer ferstar found that ZCode, the coding agent built by Z.ai around its GLM models, silently packages a user's entire workspace—including .git history, LFS caches, reflogs and global configs—encrypts it, and uploads the archive to Aliyun OSS whenever a user is logged in. The researcher captured a 313MB encrypted archive from a 345MB commercial project spanning over 42,000 files, plus 564 logged failed upload attempts during investigation.

tokenstead.ai · 2026-09-18

Zhipu's ZCode desktop app found silently uploading users' full Git repos to Aliyun cloud

A developer investigating unexpected disk usage discovered that Zhipu's ZCode AI coding app compresses and encrypts entire project workspaces—including .git history, LFS caches, reflogs and configs—and uploads them to Aliyun OSS without visible user consent. The encryption uses a server-issued RSA public key while the private key stays server-side, meaning neither the user nor the local client can ever decrypt the archives sitting on the user's own disk. In the investigated case, a 313MB encrypted baseline snapshot of a commercial project had failed to upload 564 times and remained queued locally.

blog.ferstar.org · 2026-09-18