Researcher says Z.ai's ZCode coding agent quietly uploads whole git histories, and the UI toggles do not stop it

Tokenstead published on 18 September a reverse-engineering writeup of Z.ai's ZCode client, the desktop coding agent released in July 2026 by the Beijing company behind the GLM open-weight models. The researcher, going by ferstar, says the client packages the full contents of the workspace's .git directory, LFS asset cache, reflogs and other git metadata into an encrypted archive and uploads it to Alibaba Cloud object storage on every session, alongside the usual chat traffic. The Hacker News discussion had 83 points 1.5 hours after posting.

What is uploaded

The captured archive from a 345 MB commercial workspace of 42,411 files came out to 313 MB. The writeup measures the .git directory at 86.6 percent of the payload, alongside the LFS asset cache, reflogs, git logs and global app configs. Ferstar's point is that a .git directory carries the full history of a project: deleted API keys, reset commits, unpushed branch names that describe unreleased plans, and every internal hostname that once ended up in a config file.

The upload path is packaged workspace to tar.gz, encrypted with AES-256-CTR under a key that is wrapped with an RSA public key the ZCode servers hand out on request, then posted to Alibaba Cloud OSS. The client cannot decrypt its own archive: ferstar says every local private key failed. The private key sits only on Z.ai's servers, which the writeup argues is the point.

The settings that do not do anything

Two UI toggles look like they might turn this off and do not. "Optimize Experience" controls training authorisation, not upload. "Repo Snapshot Indexing" controls a separate server-side indexing step, not the client-side packaging. The capture routine starts unconditionally when the app launches. Ferstar's own session recorded 62 capture events, firing before every prompt and on task completion.

Z.ai's privacy policy mentions collecting "text, files, and code submitted during conversations," but does not disclose that entire workspaces and git histories are packaged and uploaded from the machine. A Z.ai executive is on record on X saying the company would not implement "anything beyond what's listed" on the ZCode site; workspace snapshotting is not listed.

The vendor response so far

At the time of writing, Z.ai's official account had not responded to the disclosure. An affiliated ZCode team account replied to ferstar with "hey I am sorry to let you find it," which the writeup treats as a confirmation rather than a rebuttal.

What to do this week

If a team member has run ZCode against a private repository, treat the whole git history as already sent. Rotate credentials that ever appeared in the history, including deleted ones: git log -p finds them, and so does whoever holds the archive. Review branch names for anything that names a client, an unreleased product or a customer, and note what a competitor would learn from reading them.

To stop the upload without uninstalling, ferstar recommends removing the local checkpoints directory and setting the immutable-file flag on it so ZCode cannot recreate it (chattr +i on Linux, chflags uchg on macOS). Checkpoint rollback stops working in exchange.

For teams evaluating a new coding assistant, the transferable lesson is that a client can implement policy purely on the server side, so a local toggle in the UI is worth exactly as much as the client-side code that reads it. If the same key that sends your code cannot also read the archive back, the vendor is the only reader.

Source

• Primary: Tokenstead: ZCode, the GLM coding agent, silently uploads your git history (18 September 2026)
• Community discussion: Hacker News thread, 83 points