{
  "id": 8235247,
  "title": "ZCode, the GLM coding agent, silently uploads your Git history",
  "url": "https://urgent.news/2026/09/18/zcode-the-glm-coding-agent-silently-uploads-your-git-history",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-18T10:35:28.000Z",
  "source": {
    "name": "Hacker News",
    "slug": "hacker-news",
    "url": "https://tokenstead.ai/guides/zcode-silent-git-history-upload"
  },
  "original_language": "en",
  "account": "On September 18, 2026, a developer named ferstar published a reverse-engineering analysis of ZCode, an AI coding desktop application developed by Z.ai, a Beijing-based company behind the GLM family of open-weight models. ZCode silently packages a user's entire workspace, including the .git history, LFS asset cache, reflogs, and global app configs, encrypts it, and uploads the archive to Aliyun OSS, Alibaba Cloud's object storage. The researcher's capture demonstrated a 313MB encrypted archive created from a 345MB commercial workspace consisting of 42,411 files. The company's closed harness for GLM models has sparked controversy, with users questioning the trustworthiness of closed-source AI harnesses.",
  "summary": null,
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}