Zhipu’s ZCode AI coding assistant silently packaged users’ entire workspaces — including full Git history, API keys, and personal configuration files — and uploaded the encrypted data to Zhipu-controlled cloud storage without user consent or an opt-out. The behavior stemmed from a default-enabled “Codebase Indexing” feature that was undisclosed in ZCode’s privacy policy, and affected users could not access or delete the data Zhipu had collected. Zhipu apologized, disabled the feature, pledged to destroy the collected data, and open-sourced ZCode for independent review.