ZCode, the GLM coding agent, silently uploads your Git history
The article's core allegation is not ordinary git-log sharing but a closed harness uploading a server-decryptable copy of the repository and its history; the sparse discussion mostly turns that into a broader argument about trusting closed-source agent runtimes, with a terminology objection and a caveat about Opencode's own past behavior.
The brief
A Tokenstead guide reports that ferstar reverse-engineered ZCode, Z.ai's closed-source GLM coding desktop app, and found it silently packages the user's workspace, including full .git history, LFS cache, reflogs, and configs, then encrypts and uploads the archive to Aliyun OSS whenever the user is logged in. The article claims the encryption key is wrapped with a server-provided RSA public key whose private key is held only by Z.ai, that UI toggles do not stop capture or upload, and that the privacy policy does not disclose workspace/git-history uploads. It recommends a filesystem-level mitigation: making the checkpoints directory immutable, at the cost of breaking checkpoint rollback.
- The reported capture is large and repository-focused: one 313MB encrypted archive came from a 345MB workspace with 42,411 files, and the .git directory was 86.6% of the payload.
- The upload pipeline is described as host-level, not an agent tool: credentials come from zcode.z.ai, the client packs and encrypts locally, then POSTs directly to Aliyun OSS, which callbacks to Z.ai.
- The encryption is envelope-style: AES-256-CTR payload encryption with the symmetric key wrapped by an RSA-OAEP public key delivered by the server; the article says the matching private key lives only in Z.ai's cloud.
- The article claims the visible settings are misleading: 'Optimize Experience' controls training authorization and 'Repo Snapshot Indexing' controls server-side indexing, but neither stops local packaging and upload.
- The article says the privacy policy, FAQ, and changelog do not mention packaging and uploading entire workspaces or git histories, and that the agent's tool surface contains no snapshot, upload, or telemetry tools.
- The proposed mitigation is to make ~/.zcode/v2/checkpoints immutable with chattr +i on Linux or chflags uchg on macOS; this stops the upload but disables checkpoint rollback.
In the discussion
The supplied comments are sparse and mostly debate trust in closed-source versus open-source agent harnesses. One commenter challenges the article's terminology, arguing it conflates 'git history' (git log) with the git repository. Others recommend open harnesses, name specific tools, dispute one tool's reputation, and note a temporary Z.ai usage offer.
Terminology objection
A commenter says the article cannot distinguish between git history as 'git log' and the git repository, and notes that Claude Fable uploads their git log to Anthropic servers daily.
Closed-source harnesses as a red flag
A commenter argues closed-source agents are a red flag regardless of whether they come from China or America, and recommends open harnesses with good reputations and enough users to notice malicious code, naming Opencode and Pi.
Open-harness preferences
Another commenter says never use a harness unless it is open source, prefers DeepSeek Harness for coding and Hermes for other tasks, mentions OpenCode as weak at managing long-running services, and notes others swear by Pi.dev.
Opencode reputation challenged
A reply disputes listing Opencode as having a good reputation, citing a prior 'harness scans the whole user directory' issue and saying the response was code signing, which they see as unrelated and evidence of weak engineering culture.
Temporary usage deal
A commenter notes Z.ai is temporarily offering unlimited off-peak usage with its harness, calling it a good deal if your project is public even with this news.