ZCode, the GLM coding agent, silently uploads your Git history
Z.ai's ZCode coding agent silently uploads users' full Git history and workspace archives to Aliyun OSS; settings toggles do not stop it.
Researcher ferstar reverse-engineered ZCode, Z.ai's desktop coding agent for its GLM models, and found it packages the entire workspace, including complete .git history, LFS caches, and configs, into an encrypted archive uploaded to Aliyun OSS whenever the app is logged in. The archive uses envelope encryption with a server-delivered RSA-OAEP public key, so users cannot decrypt their own 313MB capture from a 345MB, 42,411-file workspace. Settings toggles only control training authorization and server-side indexing, while a host-level capture sidecar runs unconditionally before every prompt. The disclosure drew over 276,000 views, highlighting that the open GLM weights do not make the closed-source harness trustworthy.
- Uploads full .git history, LFS caches, and configs to Aliyun OSS when logged in
- Server-only RSA-OAEP key means users cannot decrypt their own uploaded archives
- Training and indexing toggles do not disable the unconditional capture sidecar
- Git directory was 86.6% of one payload, exposing deleted secrets and unpushed branches
- Disclosure drew 276,000 views; closed harness differs from open GLM weights
- Vendors
- Z.ai
- Products
- ZCode
- Organizations
- Alibaba Cloud
- Countries
- China
- AI models
- GLM
From the original article
6 min read at tokenstead.ai
On September 18, 2026, a developer going by ferstar published a reverse-engineering walkthrough of ZCode, the AI coding desktop app from Z. ai, the Beijing-headquartered company behind the GLM family of open-weight models - the same models running on local rigs all over the local-AI community, including GLM-5. 3-Flash, tracked on this site.
By cdnsteve · tokenstead.ai
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.