Ethics & SecuritySeptember 18, 2026
-18
āļø
ZCode secretly uploads your entire Git history
The GLM coding agent ZCode reportedly uploads users' complete Git history to Alibaba Cloud servers without their knowledge.
#Privacy#GLM#Z.ai#Security#Open-Weight
š„ What happened
A developer named ferstar reverse-engineered ZCode, Z.ai's AI coding app (the GLM makers). On every login, it silently packs the entire workspace ā full .git history, LFS cache, reflogs ā encrypts it, and uploads it to Aliyun OSS. His capture: a 313MB archive from a 345MB workspace, 42,411 files.
š” Why it matters
The .git directory alone is 86.6% of the upload ā that's the complete repo lineage since day one, including deleted API keys and unpushed branches. The UI toggles stop nothing: the capture sidecar runs unconditionally at startup. The RSA private key lives only in Z.ai's cloud ā you can't decrypt your own archive.
ā” Our take
Running GLM locally doesn't mean the harness is open. ZCode is closed-source telemetry dressed as a coding tool ā Petri Kuittinen nailed it: don't trust closed-source AI harnesses.
The title, summary and analysis of this item were produced automatically by an AI system and have not been editorially reviewed. They may contain errors, bias or omissions ā when in doubt, read the linked original source.
