Your AI Coding Agent Might Be Uploading Your Whole Codebase: How to Check What Dev Tools Send to the Cloud
AI coding agents feel like magic. You point one at a project, describe what you want, and it reads your files, runs your terminal, and edits code across your whole repository. But to do all that, it has to see all that — and a recent finding is a sharp reminder that “the tool can see your project” and “the tool sends your project somewhere else” are two very different things.
Here’s the direct answer: a security researcher reverse-engineered ZCode, a popular AI coding agent built on the GLM-5.3 model, and found it silently packages your entire workspace — including your full Git history — and uploads that snapshot to cloud object storage, encrypted with keys the service controls, not you. In plain terms: without an obvious prompt, the tool can ship a complete copy of your project — and every version of it you’ve ever committed — off your machine, where you can’t get it back.
Why this matters even if you don’t write code
It’s tempting to file this under “developer problem.” It isn’t, for two reasons.
First, more non-developers than ever are “vibe coding” — building small apps, scripts, and automations by chatting with an AI agent. If that’s you, the agent is reading whatever folder you opened, which might hold client files, spreadsheets, API keys, or notes you never thought of as “a codebase.”
Second, this is really a story about a pattern, not one product: an AI tool doing more than it says, quietly, in the background. We’ve seen versions of this before — an AI assistant that connects to your Gmail, Slack, and Notion and can read far more than you intended, or a personal agent you hand real account access to run errands. The specifics change; the question doesn’t: what is this thing actually doing with my stuff?
What “uploading your Git history” really means
When you work on almost any software project, a hidden folder quietly records every change you’ve ever saved — every version, every message, sometimes secrets that were committed by accident and “deleted” later. That history is the archive. Deleting a password from your current files does not remove it from the history; it’s still sitting in the record.
So when a tool uploads your full history, it isn’t just sending today’s code. It can be sending:
- Old passwords, API keys, or tokens that were committed once and never truly scrubbed.
- Internal comments, customer names, or private notes from months ago.
- The complete shape of a project you may be under contract to keep confidential.
And because the researcher found the uploads were encrypted with server-held keys, you can’t decrypt or verify what’s stored — you’re trusting the vendor entirely. That’s the part that turns a convenience into a real risk.
How to check what your AI dev tool is sending
You don’t need to be a security engineer. You need a short, repeatable routine you run before trusting any new tool with real work.
- Read the one paragraph that matters. In the privacy policy or docs, search for words like “upload,” “cloud,” “telemetry,” “training,” and “retention.” You’re answering one question: does my code leave my computer, and if so, what’s kept and for how long?
- Look for a local or offline mode. Good tools tell you plainly whether processing happens on your machine or on their servers, and let you choose. If a tool can’t answer “does this run locally?”, treat that as an answer.
- Watch the network, once. You can literally see a tool phone home. On Mac, the free app Little Snitch (or the built-in
lsof/nettop) shows outbound connections; on Windows, the Resource Monitor’s Network tab or a tool like GlassWire does the same. Open your AI tool, do a small task, and watch where it connects. A coding assistant talking to its model’s API is expected; a burst of traffic to a cloud storage bucket right after you open a project is worth questioning. - Give it a sandbox, not your crown jewels. Try a new agent on a throwaway folder with fake files first. See how it behaves before you ever open your real work or anything with client data in it.
- Mind what’s in the folder you open. An agent sees everything in the directory you point it at. Don’t run it from your Desktop or a folder stuffed with unrelated sensitive files. Keep projects tidy and separate.
- Scrub secrets out of the history, not just the file. If a password or key ever lived in your project, assume it’s still in the history until you’ve properly rotated it. Change the credential; don’t just delete the line.
Green flags vs. red flags
When you’re deciding whether to trust a tool, weigh these.
- Green flags: a clear, human-readable privacy policy; an explicit offline or “bring your own key” option; open-source code you or others can inspect; controls to opt out of training and telemetry; specific statements about what is and isn’t uploaded.
- Red flags: vague language about “improving our services”; no way to run locally; encryption where only the vendor holds the keys; surprise cloud-storage traffic; a free tool with no clear explanation of how it’s funded.
That last one matters. If a powerful tool is completely free with no visible business model, your data may be part of the deal — the same instinct that helps you spot a supply-chain trap in AI-suggested packages applies here.
A note on the specific tool
To be fair: this was one researcher’s reverse-engineering of one product, and the vendor may respond, add disclosures, or change the behavior. The point isn’t to declare a single app “evil” — it’s that the behavior was silent. A tool that clearly said “we snapshot your workspace to the cloud so the agent has full context, here’s how it’s secured, here’s how to turn it off” would be a defensible design choice. Doing it quietly is what turns a feature into a breach of trust — and, potentially, a breach of your own confidentiality obligations to clients or employers.
How worried should you be?
Proportionately. For a hobby project with nothing sensitive in it, an uploaded snapshot is low-stakes. For a work repository with client data, credentials, or anything under a confidentiality agreement, it’s the difference between “handy tool” and “accidental data leak you have to report.” The fix isn’t to swear off AI coding agents — they’re genuinely useful and here to stay. It’s the same discipline that protects your accounts when attackers try to drain them without your password: know what has access, know where your data goes, and make deliberate choices instead of default ones.
AI can amplify what you build in remarkable ways. The people who get the most out of it aren’t the ones who trust every tool blindly, and they’re not the ones too spooked to try anything — they’re the ones who keep the help close, ask what it’s really doing, and stay the one holding the keys.
Sources & further reading:
Related Reading
- Top AI Coding Assistants in 2026: Beyond GitHub Copilot
- 84% of Developers Use AI Coding Tools — But Only 29% Trust Them. Here’s How to Close That Gap
- Your AI Coding Assistant Can Be Tricked: The GhostApproval Flaw and How to Code Safely with AI