ZCode's desktop client contains a fully militarized data-harvesting architecture that was never disclosed, never toggleable, and never stoppable by the user. This is not an editorial characterization. It is the forensic record.
The capture worker's sole gate is a valid login token. All three user-facing privacy controls — Optimize Experience, Repository Snapshot Indexing, Memory — were independently verified set to false, and a fresh baseline snapshot was still generated the same day. The UI toggles are decoys. They govern nothing. One tester's state file logged failureCount: 564 — five hundred and sixty-four consecutive failed upload attempts before the system silently rebuilt the package and tried again. Delete the archive manually; it regenerates within thirty minutes. This is not telemetry with a bug. This is a persistence engine with a retry loop that would embarrass most APT toolkits.
The collection topology is deliberately compartmentalized across three parties. The client encrypts the payload with AES-256-CTR, wraps the symmetric key with an RSA public key fetched on-the-fly from zcode.z.ai, then POSTs the ciphertext directly to Alibaba Cloud OSS — bypassing Zhipu's own business servers entirely. The wrapped key is delivered back to Zhipu via an OSS upload callback. The fixed output filename repo-snapshot.tar.gz.enc confirms this isn't ad hoc — it's a standardized bulk-ingestion pipeline. The lastAcceptedManifestHash field is only written after OSS confirms receipt: acknowledgment-based delivery verification. Three principals, compartmentalized data flows, confirmed delivery. The architecture is indistinguishable from a signals-collection system.
The .git inclusion is the payload that transforms this from an embarrassment into a catastrophe. ZCode's filter logic hard-codes a short-circuit: any path inside .git returns include: true before large-file, binary, and secret-pattern exclusions execute. Working-tree .env and .pem files get filtered. But every credential ever committed — then "deleted" via git rm, force-pushed, believed gone — lives permanently in the object database and ships wholesale. One snapshot measured 758 MiB; 749.8 MiB of it was .git. The working source code was single-digit megabytes. Zhipu was not collecting code. It was collecting history — the complete archaeological record of how software gets built, including the secrets that fund it.
And it extends beyond the repository. The snapshot manifest confirms inclusion of workspace-external data from ~/.zcode: MCP server configurations (which routinely embed API tokens, database credentials, and endpoint URIs for every connected service), global agent memory, hooks, skills metadata, plugin manifests, and AGENTS.md behavioral instructions — each up to 20 MiB. This is not "your repo." It is a complete operational profile: what tools you use, what services they authenticate to, and what secrets those integrations hold. Confirmed scope: workspace directory plus ZCode's global config. Not yet evidenced: arbitrary OS folders. But MCP configs alone can contain keys to every downstream system an engineering team touches.
The Contrarian Thesis the Market Hasn't Processed
Zhipu's "free tokens" weren't the product. You were. The five-trillion-token giveaway that drove ZCode to one million users by August was not a loss-leader for API revenue. It was customer-acquisition cost for a collection campaign. Every free token spent was an incentive to log in — and login was the only condition the capture worker checked. The economics invert entirely: Zhipu was paying users to deliver their proprietary codebases, credential histories, and infrastructure topologies to Alibaba Cloud OSS. The marginal cost of tokens is near-zero against the training-data value of one million developers' complete Git histories.
The open-sourcing promise is free because the harvest is already finished. Zhipu announced it will open-source the ZCode client "in the near future." This is the optimal move precisely because it costs nothing. The collection infrastructure has been operating since at least early July — one user traced successful uploads to July 8, meaning the pipeline ran silently for over ten weeks across a million-user base. At confirmed per-user volumes of 300–750 MiB of .git content alone, with heavy users potentially exceeding 50 GB of total workspace data, the aggregate corpus is staggering. Open-sourcing the client now is not transparency. It is locking in the gains and burning the tool.
The Anthropic distillation report is not a coincidence — it's the other half of the same acquisition strategy. One week before this disclosure, Anthropic publicly named Zhipu as one of seven China-based labs running industrial-scale model distillation against Claude — 3.4 million exchanges through 273 fraudulent accounts. Combine that with ZCode's collection pipeline: on one vector, Zhipu was systematically extracting frontier model capabilities via API abuse; on another, it was harvesting real-world proprietary codebases, credential graphs, and development workflows at scale. These are not separate incidents. They are complementary inputs to the same training flywheel. One supplies the reasoning capability. The other supplies the grounding data that makes it commercially lethal.
The next-generation exfiltration is already designed and it's invisible. The forensically literate insight buried deepest in the discussion: the successor to sidecar capture is model-mediated exfiltration. The API's tool-calling interface can inject read_file commands that return workspace content through the conversation stream itself — making collection indistinguishable from normal agent operation, billable to the user, and invisible to any client-side audit. ZCode's sidecar was the crude version. The refined version runs through the model's own tool loop and leaves no forensic artifact at all. Every closed-source coding agent with tool-use capability is one server-side prompt injection away from becoming this.
Enterprise users were not exempted. Community-confirmed: corporate workstations running ZCode received identical treatment. This means government, defense-adjacent, and regulated-industry repositories were harvested with the same pipeline, under the same server-held keys, to the same Alibaba Cloud OSS endpoints. The compliance exposure for any organization that deployed ZCode in a controlled environment is not a privacy incident — it is a potential breach-notification obligation under virtually every major data-protection regime.
The Geopolitical Kill Shot
This is where the damage becomes irreversible and extends far beyond Zhipu. The incident delivers a forensically documented, independently verified, multi-platform-confirmed case study to every Western regulator, procurement officer, and sovereign technology advisor arguing for the exclusion of Chinese-origin AI tools from sensitive environments. It is no longer a hypothetical. It is an exhibit.
The collateral casualties are Qwen, DeepSeek, Kimi, MiniMax, and every Chinese AI company selling enterprise services, API access, or on-premise deployments into Southeast Asia, the Middle East, Europe, and the Gulf states. Middle Eastern sovereign clients already preferred Mistral over Chinese alternatives on data-sovereignty grounds; this converts soft preference into hard procurement policy. European GDPR enforcement authorities now have a live referral. The entire Chinese AI export ecosystem inherits a trust deficit manufactured by a single actor — and there is no technical rebuttal available, because the forensic evidence is public, reproducible, and damning.
MiniMax open-sourced its Code CLI within hours of the disclosure. That is not altruism. That is competitive positioning at the speed of a crisis. The market's revealed preference is now binary: open-source with auditable data paths, or you are assumed to be collecting. There is no middle ground left.