On September 18, tech blogger ferstar published a reverse-engineering analysis finding that Zhipu's ZCode, whenever a user is logged in, packages and encrypts the entire working project along with its complete modification history in the background and uploads it to a cloud server, with no genuinely usable off switch in the interface and the decryption key kept only on Zhipu's side. Ferstar had noticed abnormal hard drive usage in ZCode's local directory and found an encrypted file of about 313MB, whose manifest showed the package covered about 42,000 files, of which more than 80% were project history modification records, including caches of downloaded large files and local operation logs; code analysis found the history record was exempted from all security filtering rules, with the pass-through placed before key filtering and size limits. Zhipu quickly apologized, saying the problem stemmed from a feature enabled by default, that data was destroyed immediately after use, and promising to open-source the codebase soon and bring in third-party review. The article notes similar issues: independent researcher cereblab proved via packet-capture analysis that xAI's Grok Build uploads entire projects to Google Cloud Storage, and Claude Code was found sending back location and identity information, which an Anthropic engineer confirmed was a deliberate experiment.