A free coding app quietly uploaded 42,000 files from one laptop.
Developers found on Friday that Zhipu's ZCode app packs up your whole workspace once you log in. One archive held 42,000 files, and 86.6% of it was Git history. Zhipu apologised, fixed it and promised to open source ZCode, but one firm now wants answers.
Why it mattersGit history keeps deleted passwords and keys long after you strip them from the code. The upload ran by default, and the app had no switch to turn it off.
Read in the app — free, in 9 languages
Related stories
A fake Claude Code update put a backdoor on up to 5,000 computers.2026-10-30Reddit will soon make you log in just to read it.
2026-10-30A worker's personal Claude agent sat on a Pentagon network for months.
2026-10-30GitHub's Copilot now picks the AI model for each coding task itself.
2026-10-29Mistral gave away its trillion-parameter model, with one catch.
2026-10-29