ZCode uploads your full .git history before every prompt

A teardown of Z.ai's ZCode agent found it packs your entire workspace, encrypts it, and sends it to Aliyun OSS with a callback to Z.ai's backend, before every prompt.

The researcher pulled this from the app's asar bundle and session logs. One active session showed 62 capture events, fired before every prompt and again on task completion. A single 42,411-file workspace produced a 313MB archive.

The .git directory accounted for 86.6% of that payload. That means full repository history goes with it. Deleted API keys, unpushed branches, internal hostnames sitting in .git/config that never made it into a commit anyone meant to share.

The encryption is what turns this from careless into locked out. It's envelope encryption with an RSA key that only Z.ai holds, so you can't open your own archive to check what left your machine.

This is single-source reporting, and Z.ai hasn't issued an official response. One affiliated account replied with "hey I am sorry to let you find it," which reads like an acknowledgment but isn't a company statement, so treat the finding as credible and unconfirmed until Z.ai says more.

Either way, the fix doesn't wait on a vendor statement. Run du -sh .git on whatever repo you'd least want uploaded, and think about what secrets have rotated through that history and never got scrubbed. If a coding agent you didn't build yourself has filesystem access, assume it can read past what you'd have handed it on purpose.