ZCode, the GLM coding agent, silently uploads your Git history

tokenstead.ai ·2h ago

On September 18, 2026, a developer named ferstar published a reverse-engineering analysis of ZCode, an AI coding desktop application developed by Z.ai, a Beijing-based company behind the GLM family of open-weight models. ZCode silently packages a user's entire workspace, including the .git history, LFS asset cache, reflogs, and global app configs, encrypts it, and uploads the archive to Aliyun OSS, Alibaba Cloud's object storage.

The researcher's capture demonstrated a 313MB encrypted archive created from a 345MB commercial workspace consisting of 42,411 files. The company's closed harness for GLM models has sparked controversy, with users questioning the trustworthiness of closed-source AI harnesses.

Written by urgent.news from Hacker News's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.

Read the original at tokenstead.ai →

More in Tech

Apple Fifth Avenue cube changes colors for iPhone 18 Pro release

Apple's famous glass cube on Fifth Avenue in New York has been turned burgundy, silver, and glacier as it prepares to welcome the first buyers of the iPhone 18 Pro .

2h ago ·appleinsider.com

Inside the fake AARTO fine scam

A possible eNatis hack sees scammers sending fake fines with motorists’ correct number plates and registration details.

2h ago ·itweb.co.za

Six Hundred Reports Left Our Systems Each Month and Ninety Were Read

A supplier quoted us a substantial figure to move our reporting estate onto a new platform, priced per report. That quotation was the first time anybody had counted them.

2h ago ·dev.to

Every Department Wanted the Premium Option Until It Appeared on Their Budget

For as long as I have worked here, the technology budget sat in one place: mine. Every licence, every mailbox, every test environment and every mobile handset was funded centrally, which meant that to…

Central technology budget managed across departments
Serguey Shinder identified predictable issues with central funding
Showback introduced to show technology consumption costs

2h ago ·dev.to

Setting Up a Reliable .NET MAUI Development Environment on macOS

Setting up a new development machine for a .NET MAUI project sounds simple. Install .NET. Install Xcode. Install Android Studio. Clone the repository. Run the application.

Install appropriate .NET SDK version and verify with dotnet --version.
Install .NET MAUI workload with dotnet workload install maui.
Configure Xcode and verify iOS Simulator readiness.

2h ago ·dev.to

Splunk Open Sources Token Meter Tool for Application Developers

Splunk’s open-source Token Meter gives developers real-time visibility into AI coding agent activity, token consumption and estimated costs across tools including Claude Code, Codex and Cursor.

2h ago ·devops.com