GoKawiilZ.ai's ZCode desktop app secretly uploads users' full Git history to Alibaba Cloud
A reverse-engineering report by developer ferstar found that ZCode, the coding agent built by Z.ai around its GLM models, silently packages a user's entire workspace—including .git history, LFS caches, reflogs and global configs—encrypts it, and uploads the archive to Aliyun OSS whenever a user is logged in. The researcher captured a 313MB encrypted archive from a 345MB commercial project spanning over 42,000 files, plus 564 logged failed upload attempts during investigation.