ZCode’s Full Git History Upload Raises AI Coding Privacy Concerns

As AI coding assistants move beyond autocomplete into file editing, task execution, and cross-module debugging, they need access to increasingly broad local context. That improves productivity, but it also makes a basic question unavoidable: exactly what does the tool read, what does it upload, and how long is that data retained?

What happened

The recent ZCode discussion is not simply about an AI tool reading source code. The central issue is that its end-to-end long-running task feature was reported to package and upload a project’s complete .git history. The official community also confirmed the behavior. According to the supplied material, the incident has delayed the GLM-5.5 release, while the parties involved are coordinating on the matter.

A complete Git history is much broader than the current working tree. Code removed from the main branch may still exist in earlier commits or other branches. Commit messages, file paths, diffs, and development patterns can also reveal project architecture, remediation work, internal priorities, or sensitive implementation details. Therefore, the assumption that a tool “only uploads the current project” does not necessarily describe the actual exposure surface.

Questions developers should ask

• Upload scope: Can the tool inspect hidden directories, commit history, untracked files, or other branches?
• Trigger conditions: Which features expand collection, and is the user warned before those features run?
• Data lifecycle: Is uploaded content used for training? How long is it retained, and can it be deleted?
• Enterprise controls: Are tenant isolation, permissions, regional storage, and audit logs available?
• Local safeguards: Can sensitive repositories disable long-running tasks or restrict network access?

Why it matters

The incident shows why AI coding security reviews cannot stop at asking whether the current file is uploaded. Teams need to understand the full data path: how context is discovered, how files are packaged, what metadata is sent, and whether the data receives additional processing. Companies should include AI coding tools in software supply-chain reviews and data-loss-prevention audits, alongside repository permissions and secret management.

For individual developers, the safest assumption is that an AI coding tool is an external service with defined privileges, not an automatically trusted local extension. Until the upload boundary is clear, repositories containing trade secrets, credentials, or unreleased designs should not be exposed to long-running automation. Vendors, meanwhile, should provide visible, configurable, and auditable data controls, including a meaningful opportunity to refuse sensitive operations. AI-assisted development can enter production responsibly only when its efficiency gains and privacy boundaries are both manageable.

Source: OSChina