ZCode, the GLM coding agent, silently uploads your Git history
Article URL: https://tokenstead.ai/guides/zcode-silent-git-history-upload Comments URL: https://news.ycombinator.com/item?id=49752422 Points: 247 # Comments: 58
On September 18, 2026, a developer named ferstar revealed a concerning discovery about ZCode, an AI coding desktop app developed by Z.ai, a company based in Beijing. The app silently packages and uploads the user's entire workspace, including the .git history, LFS asset cache, reflogs, and global app configurations, to Aliyun OSS, Alibaba Cloud's object storage.
This was discovered after ferstar reverse-engineered the app and captured a 313MB encrypted archive from a 345MB commercial workspace. The company's stance is that ZCode is closed-source and that the harness is proprietary, offering a first-party integration not available with third-party editors. Despite the app's open weights, the harness remains closed, raising privacy concerns.
The encryption key used to encrypt the archive is only held by Z.ai's cloud, leaving the user unable to decrypt the data. The .git directory alone makes up 86.6% of the payload, which could potentially expose deleted API keys, unreleased product plans, and other sensitive information. ZCode's privacy policy does not mention these practices, suggesting a lack of transparency from the company.
Written by urgent.news from Hacker News Best's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
This story
This is one outlet's version. Read the fullest account.
- ZCode, the GLM coding agent, silently uploads your Git history tokenstead.ai
- Inside ZCode: Silently uploading your Git history to the cloud blog.ferstar.org
