gg2
nodeloc.com

ZCode silently uploads Git history to cloud

The gist

A researcher found ZCode silently uploaded full .git history to Aliyun OSS.
The case raises questions about what AI coding tools send off your machine by default.

How it unfolded

  1. Sep 17, 2026ZCode changelog v3.12.3 is released with no fix entry.
  2. Sep 18, 2026ferstar publishes a blog post titled 'Inside ZCode: Silently Uploading Your Entire Git History to the Cloud' and posts on X asking @Zai_org why ZCode silently packs entire workspaces plus full .git history and uploads to Aliyun OSS on login.
  3. Sep 18, 2026Windows on-machine verification (build 3.12.3.7463) confirms the same behavior: 32 workspaces snapshotted, largest single package 107MB, 152 failed upload retries, and about 14 workspaces with no failure records indicating successful uploads.

Sources

Read the full story in the app gg2 — free on the App Store