Reverse-engineering analysis revealed that ZCode, an AI coding app from Beijing-based Z.ai, silently packages and encrypts users' entire Git history and workspace data, uploading it to Aliyun OSS with encryption keys held only by Z.ai's servers. The discovery sparked privacy concerns across developer communities, with critics noting the closed-source harness contradicts assumptions about openness tied to Z.ai's open-weight GLM models.