ZCode, the GLM coding agent, silently uploads your Git history
4 hours ago
- A developer reverse-engineered ZCode, the AI coding desktop app from Z.ai, discovering it silently uploads a user's entire workspace including complete .git history, LFS asset cache, and configs to Alibaba Cloud's Aliyun OSS when logged in.
- The upload occurs regardless of user settings, as the capture sidecar is instantiated at startup with no gating on preferences, and the encryption key for the uploaded archive is kept only on Z.ai's server, preventing user decryption.
- The workspace packaging focuses heavily on .git directories (86.6% of payload), and the privacy policy does not mention this behavior, despite Z.ai's executives denying spyware in ZCode.
- The vulnerability cannot be stopped by toggling settings like 'Optimize Experience' or 'Repo Snapshot Indexing,' as they only control data indexing or training authorization, not the upload process.
- The only effective fix is filesystem-level restriction of the checkpoints directory, which disables the snapshot rollback feature but allows normal chat and tool calls.
- The incident highlights trust issues in AI coding harnesses, emphasizing that a locally-run model with a cloud-connected runtime is not truly local, and users should verify runtime transmission and encryption practices.
- Z.ai, which went public in 2026, has not publicly responded, and the discovery has garnered over 276,000 views on social media, with some community members advising against using closed-source AI harnesses.