Research by developer ferstar has revealed that ZCode, the AI coding desktop application from Z.ai, silently exfiltrates a user's entire workspace and complete Git history to Alibaba Cloud's Aliyun OSS. Unlike standard telemetry that collects conversation snippets, ZCode's host-level sidecar—which operates independently of the agent's tool loop—packages the full repository lineage, including .git/lfs assets, objects, and reflogs. In one test, a 345MB workspace resulted in a 313MB encrypted archive containing over 42,000 files. The exfiltration utilizes envelope encryption, where data is encrypted with AES-256-CTR and the symmetric key is wrapped using an RSA-OAEP public key provided by the Z.ai server. This ensures the resulting ciphertext cannot be decrypted by the user or the local client, as the private key remains exclusively on Z.ai's servers. Notably, the app's UI toggles for "Optimize Experience" and "Repo Snapshot Indexing" do not stop this process; they only control data usage for model training or server-side indexing. The mechanism triggers unconditionally upon a valid JWT login, occurring before every prompt and task completion. To prevent this, researchers recommend using filesystem-level locks, such as 'chattr +i' on Linux, to make the local checkpoint directory unwritable.