Inside ZCode: Silently uploading your Git history to the cloud
A code-assistant tool called ZCode has been found silently packaging and uploading users’ entire workspaces and Git histories to the vendor’s servers, allegedly for “codebase indexing” and cloud-based wiki generation, without clear disclosure or an obvious opt-out. Commenters argue this behavior crosses the line into malware-like exfiltration, amplifying existing concerns about closed-source AI “harnesses,” cheap tokens, and opaque data handling practices, especially from major Chinese AI providers. Many call for stricter compartmentalization and sandboxing of agents, greater reliance on open-source tools and self-hosted models, and note that the company has since apologized, claimed the data was not retained, and promised to open-source ZCode to rebuild trust.
Silent Git Uploads & Privacy Concerns
- ZCode was observed silently packaging and uploading entire workspaces and Git histories to the cloud, with data encrypted using keys not held by users.
- Many see this as crossing from “telemetry” into malware-like behavior: no clear notice, no explicit consent, and targeting obviously sensitive data (repos, histories, dotfiles, .env, etc.).
- Some connect this to earlier incidents (e.g., Grok’s CLI uploading repos) and argue the pattern is systemic in AI tooling, not an isolated case.
Trust in Closed-Source Harnesses
- Strong sentiment that closed-source agents/harnesses are inherently untrustworthy, regardless of country of origin.
- Even open-source tools are “barely” trusted; examples are given where popular open harnesses scanned user directories or quietly sent prompts to cloud summarization services despite self-hosted settings.
- Several alternatives are mentioned (various open harnesses and agent frameworks), but none are portrayed as flawless.
Sandboxing and Operational Hygiene
- Many advocate strict sandboxing: separate user accounts, Docker containers with limited mounts, firewalled egress, and explicit read scopes for project files vs dotfiles vs ignored files.
- Agents are likened to untrusted users on your machine; they will naturally “hunt for context,” including dotfiles and ignored files, so technical controls are considered mandatory.
Vendor Response & Open-Sourcing Pledge
- Z.ai’s statement (summarized in the thread):
- Blames the behavior on a “codebase indexing” / Repo Wiki feature that uploads repo data to generate documentation, then claims to immediately destroy the data.
- Says the feature was enabled by default early on; apologizes and claims it is now fixed.
- Promises to open-source ZCode, invite third-party review, and offers extra quota as compensation.
- Some see open-sourcing after a scandal as a trust-repair tactic; others reserve judgment until code is actually released.
Legality, Ethics & Geopolitics
- A number of commenters argue this looks like criminal hacking and question whether laws meaningfully apply to corporations.
- Comparisons are made to Apple/Google cloud practices and to cheap token pricing as a signal of hidden data extraction incentives.
- There is extended debate about PRC companies, state regulation, and broader surveillance capitalism, including a Chinese commenter describing pervasive domestic data abuse and weak consumer protection.