{
  "id": 8274081,
  "title": "ZCode, the GLM coding agent, silently uploads your Git history",
  "url": "https://urgent.news/2026/09/18/zcode-the-glm-coding-agent-silently-uploads-your-git-history-8274081",
  "topic": "ai",
  "section": "AI",
  "published": "2026-09-18T10:35:28.000Z",
  "source": {
    "name": "Hacker News Best",
    "slug": "hacker-news-best",
    "url": "https://tokenstead.ai/guides/zcode-silent-git-history-upload"
  },
  "original_language": "en",
  "account": "On September 18, 2026, a developer named ferstar revealed a concerning discovery about ZCode, an AI coding desktop app developed by Z.ai, a company based in Beijing. The app silently packages and uploads the user's entire workspace, including the .git history, LFS asset cache, reflogs, and global app configurations, to Aliyun OSS, Alibaba Cloud's object storage. This was discovered after ferstar reverse-engineered the app and captured a 313MB encrypted archive from a 345MB commercial workspace. The company's stance is that ZCode is closed-source and that the harness is proprietary, offering a first-party integration not available with third-party editors. Despite the app's open weights, the harness remains closed, raising privacy concerns. The encryption key used to encrypt the archive is only held by Z.ai's cloud, leaving the user unable to decrypt the data. The .git directory alone makes up 86.6% of the payload, which could potentially expose deleted API keys, unreleased product plans, and other sensitive information. ZCode's privacy policy does not mention these practices, suggesting a lack of transparency from the company.",
  "summary": "Article URL: https://tokenstead.ai/guides/zcode-silent-git-history-upload Comments URL: https://news.ycombinator.com/item?id=49752422 Points: 247 # Comments: 58",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 3,
    "also_reported_by": [
      {
        "outlet": "Hacker News Best",
        "title": "Inside ZCode: Silently uploading your Git history to the cloud",
        "url": "https://urgent.news/2026/09/18/inside-zcode-silently-uploading-your-git-history-to-the-cloud",
        "published": "2026-09-18T06:11:17.000Z"
      },
      {
        "outlet": "Hacker News",
        "title": "ZCode, the GLM coding agent, silently uploads your Git history",
        "url": "https://urgent.news/2026/09/18/zcode-the-glm-coding-agent-silently-uploads-your-git-history",
        "published": "2026-09-18T10:35:28.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}