#zhipu-ai

September 19, 2026

Zhipu AI's ZCode was found snapshotting entire workspaces to Alibaba Cloud OSS after login, reportedly including full .git history, LFS objects and reflog, encrypted with a key held only server-side, with no setting to disable it and no disclosure in the privacy policy. It was spotted by a blogger clearing ~/.zcode; a follow-up compares the telemetry behaviour of seven AI coding tools side by side (incident write-up, tool comparison). · AI & Model Security