Why This Comparison Exists
On 17 September a developer found 700MB in ~/.zcode and traced it to staged workspace snapshots. One project came to 42,411 files in a 313MB encrypted archive, 86.6% of it Git data.
The useful question is not which vendor to be angry at. It is what any AI coding tool sends, and how you would know.
What ZCode Was Sending
- Full workspace including
.git/objects/, .git/lfs/ and .git/logs/
- Source, configuration and global application settings
- Up to 62 capture events in one active session
- AES-256-CTR content encryption with the private key held server-side only
- Direct form POST to Aliyun OSS, bypassing Z.ai servers
Two settings looked like privacy controls. Optimize Experience governed training use. Repo Snapshot Indexing governed server-side indexing. Neither governed capture, which ran unconditionally at startup.
Current State
Z.ai says this is fixed in version 3.14.0 and that uploaded data was destroyed after Repo Wiki generation. On 21 September the harness was open-sourced under Apache-2.0, which is a real remediation because it makes current behaviour auditable by anyone.
What remains unverifiable from outside is whether snapshots already in object storage were purged. The original researcher said so, and it is the honest position.
Claude Code
Claude Code reads files in your working directory and sends what a request needs. It does not package .git/objects/ and ship it at startup, and there is no snapshot pipeline of this kind.
That is a real difference in default behaviour. It is not a claim that nothing leaves your machine - any model-backed tool transmits the context a request requires, and you should verify that for yourself rather than take it from a comparison table.
How To Check Any Tool Yourself
- Look at the tool cache directory size after a week.
~/.zcode at 700MB is what started this.
- Watch outbound requests during startup specifically, not just during a prompt. Capture at launch was the whole issue.
- Check whether
.git is inside whatever the tool considers the workspace.
- Read what the privacy toggles actually say they control. Training use and indexing are not the same as capture.
Decision Framework
- Client code under NDA - use a tool whose data flow you have verified yourself, on a machine where you can watch the traffic.
- Repositories with secrets in history - assume any full-workspace upload is a credential exposure and rotate, regardless of vendor assurances.
- Personal or public repos - the risk is low and the convenience is real.
- Evaluating a new harness - open-source it is a genuine advantage here, which is now true of ZCode as well.
Verdict
Claude Code is the safer default today on data handling. ZCode responded seriously - a fix plus an Apache-2.0 release beats a statement - but if you ran any version before 3.14.0 against a repository with secrets in its history, treat it as an exposure and rotate.