Zhipu's official AI coding desktop app, ZCode, has been found to silently package and upload users' complete workspaces when logged in. This process includes encrypting the data and sending it directly to Aliyun OSS.
The uploaded content encompasses the entire .git history, LFS asset cache, reflogs, and global application configurations.
This behavior raises significant privacy concerns as users' code and version control data are transmitted to a cloud storage provider without explicit consent.