ZCode silently uploads your entire Git history to Z.ai's cloud
ZCode, the GLM coding agent, silently uploads your Git history
A reverse-engineering walkthrough of ZCode, Z.ai's AI coding desktop app, reveals it silently packages your entire workspace — including full .git history, LFS cache, and reflogs — encrypts it, and uploads the archive to Aliyun OSS. The encryption key is wrapped with an RSA public key whose private half lives only in Z.ai's cloud, so neither you nor the client can decrypt it. Settings toggles don't stop the capture; only making the checkpoints directory unwritable at the filesystem level does.
A key that only the server can use serves exactly one purpose: making sure the server can read your code whenever it wants.
- outloudvi
LLM-paraphrased from the original post: https://blog.ferstar.org/en/posts/zcode-silent-workspace-sna...
- philbo
Tangential, mildly amusing thing I noticed while implementing my own harness: GLM and particularly Deepseek are both fond of trying to read dotfiles and anything listed in your .gitignore files. I only noticed it because I have separate read scopes for project files, ignored files, dotfiles and external files, so the latter three always prompt me for approval.
I'm sure there's a perfectly reasonable explanation for it, which has nothing at all to do with exfiltration of secrets, but it does amuse me when it happens. I imagine the labs have access to lots of secrets that various actors would like to get their hands on...
(shameless plug for my own harness, which is open source and doesn't have a backend to send any data to: https://www.opairdev.org/ )
- Aldipower
That the article cannot distinguish between the git history 'git log' and the git repository, which is meant here, tells a lot.
Claude Fable uploads my git history (git log) every day to the Anthropic servers!
- Palmik
Seems like a repeat of the Grok CLI fiasco:
- nullbio
Evidently there's not a single inference provider that can be trusted. This is why I don't use OpenRouter either. How am I supposed to trust all of those random providers I've never heard of, when I can't even trust the ones I have heard of? Day by day, the entire industry is hellbent on proving that open-weights and self-hosting is the only safe path forward for us all.