Investigation into Four AI Coding Tools Uploading User Code (ZCode, Trae CN, Qoder CN, WorkBuddy)

Forum topic · ✨步子哥 · 2026-09-20

Summary

A zhichai.net forum post presents a screenshot-transcribed investigation into whether four AI coding assistants — ZCode (Zhipu), Trae CN (ByteDance), Qoder CN (Alibaba), and WorkBuddy (Tencent) — upload user code to the cloud. Based on decompiled local installers, forensic analysis of user data directories, runtime log inspection, changelog review, and privacy-policy comparison dated 2026-09-18, the post claims ZCode uploads the full repository including .git history with envelope encryption to Alibaba Cloud OSS and offers no opt-out; Trae CN continuously uploads codebase content to trae-api-cn.mchost.guru with a telemetry switch that cannot be disabled; Qoder CN sends full file contents to gateway.qoder.com.cn with a client switch that can be locked server-side; and WorkBuddy uploads code diffs to Tencent COS using server-issued STS credentials with no user-facing toggle. The author notes ZCode's findings were confirmed while others' evidence chains were checked. Important caveats: the original text is AI-generated and explicitly flagged as not verified, and this page is a transcription of low-resolution screenshots, not an independent audit.

Key points

This post is a restoration (screenshot transcription) of an investigation into code-upload behavior of four AI coding tools, checked on 2026-09-18 via installer decompilation, user-data forensics, runtime log analysis, changelog parsing, and privacy-policy comparison.

> Note: The original text carries an AI-generated disclaimer: "This article was automatically generated by AI analysis, does not represent reality, please verify carefully." Illegible text is marked 〔原图不清〕 in the source; section numbering jumps from 四 to 九 as in the original. This is a transcription, not an independent security audit.

Findings by tool (per the post)

| Item | ZCode (Zhipu) | Trae CN (ByteDance) | Qoder CN (Alibaba) | WorkBuddy (Tencent) | |---|---|---|---|---| | Version | 3.11.2 | 3.3.100 | IDE 1.31.0 | 1.5.6 | | Main artifact | app.asar 307 MB | libckg.dll 37.9 MB | app.asar 131 MB | codebuddy.js 22.2 MB | | Uploads whole repo + .git | Yes | No | No | No | | What is uploaded | Full code incl. history | Entire codebase | Complete file contents | Code diffs | | Envelope-encrypted exfiltration | Yes | No | No | No | | Upload destination | Alibaba Cloud OSS | trae-api-cn.mchost.guru | gateway.qoder.com.cn | Tencent COS | | Credentials | Server-issued | Server | Server | Server STS temporary credentials | | User opt-out | None (no switch) | IDE telemetry toggle ineffective; privacy mode does not stop uploads | Switch exists but can be locked server-side | None; server-side configuration only | | Changelog disclosure | Only "memory optimization" | Not mentioned | One line: "added info reporting" | Not mentioned | | Occurred locally | Uploaded (09-06) | Continuous uploads (09-15 to 09-18) | Reported (09-02) | Not observed |

Author's stated verification level

ZCode's conclusions were confirmed.
Evidence chains for Trae, Qoder, and WorkBuddy were checked.
Project names, account names, device IDs, and tokens were redacted.
Numbers and conclusions were produced by AI without item-by-item human verification.

Caveats for readers

The source page explicitly states it is a restoration of low-clarity screenshots and does not endorse the conclusions.
Code excerpts are for reading only; some blurred identifiers were marked and may not run.
Treat all claims as unverified until independently reproduced.