Zhipu's ZCode coding tool exposed for attempting default upload of entire workspace, raising commercial project asset risk
Developer ferstar disclosed on September 18 that ZCode had attempted to upload a 313MB encrypted file containing full Git history and LFS cache without the user being aware.
On September 18, developer ferstar discovered while cleaning up disk space that Zhipu's ZCode coding tool had a 313MB encrypted file in its local directory containing nearly all the developer's commercial project assets, including full Git commit history, LFS cache, and local operation logs. ZCode had generated a workspace snapshot from the commercial project and attempted to upload it 564 times without success.
When ferstar tested with a smaller public repository, although the larger file did not upload successfully, another snapshot was shown to have been received by the server. This implies ZCode may default to packing the entire workspace, including modification history and local caches, without user awareness, raising the risk that commercial code assets could be obtained by the server. The incident was reported by media on September 24 and sparked concern in the developer community. Zhipu had not published an official remediation statement at the time of writing. The disclosure coincides with ZCode's upgrade introducing Goal, Subagents, Remote Control, and off-peak-task capabilities.