Story spreads to 276,000+ views; security researcher issues warning
2 Sep 18 6:35 AM · 6d ago · 1 article · 2 posts · 3 sources · development 2 of 2
Ferstar's original post reached 276,000 views within hours. A Chinese-language alert thread by FeiZ drew 63,800 views. Petri Kuittinen, developer of an open-source AI agent, issued a widely quoted warning against closed-source AI tools.
“My advice has been and continues to be: do NOT trust closed source AI harnesses.”
Petri Kuittinenferstar Security researcherZ.ai (Zhipu) Developer of ZCode and GLM modelsPetri Kuittinen Open-source AI agent developerFeiZ Chinese developer/community member
The whole story articlesposts the bright band is this development · numbered dots are the others · click one to jump
Reported in the same hours no headline names this development itself — these 1 claim were published in its stretch
-
first by HN Best, 6d ago · also HN Frontpage
What people said 14 voices · verbatim
-
T
Researcher ferstar reverse engineered ZCode, the closed-source AI coding desktop app from Z.ai (maker of the GLM model family), and found that while a user is logged in it silently packages their entire workspace, including full Git history, LFS cache, and reflogs, encrypts it, and uploads it to Aliyun OSS. The archive uses envelope encryption in…
-
I was wondering if I should try to create my own pseudo filesystem with FUSE for easy copy-on-write/snapshots, a native feel, and automated secrets filtering/swapping. I might as well combine that with good/easy isolation.The whole “what sandbox/VM/microVM/thing is best?” question has been bugging me a lot lately, and I no longer trust any of…
-
z.ai made a statement, screenshotted in this article: https://finance.sina.com.cn/tech/roll/2026-09-18/doc-inisfye...claude translation:Dear ZCode users,We take today's community discussion very seriously. We carried out an internal review right away, and we first want to apologize to the affected users. Here is an explanation of what happened:The…
-
Lots of modern software plays it loose with privacy, but this IMO crossing a second line: doing so with zero notification whatsoever, in a massively intrusive way, against data that is almost certainly private and possibly illegal to exfiltrate, with no obvious way to turn it off.That crosses into outright malware.Makes me not want to use GLM or…
-
Tangential, mildly amusing thing I noticed while implementing my own harness: GLM and particularly Deepseek are both fond of trying to read dotfiles and anything listed in your .gitignore files. I only noticed it because I have separate read scopes for project files, ignored files, dotfiles and external files, so the latter three always prompt me…
-
Is it much different from Apple and Google who trick user into agreeing and upload all user's data into a US cloud for convenient LE access?Also, as I understood, this is a feature to allow server-side indexing of the project. But of course I wouldn't run this, and I generally wouldn't run any IDE or AI tools without a sandbox.Sadly this plague of…
-
While we're on this, I find it really really weird how windows defender insists on sending my codex work files for analysis all the time (which I block in automatic permissions so it has to ask me in a notification). I don't think i've seen it ask to upload more than one or two things, and it doesn't do it with other AI app I use (eg Claude Code)…
-
Evidently there's not a single inference provider that can be trusted. This is why I don't use OpenRouter either. How am I supposed to trust all of those random providers I've never heard of, when I can't even trust the ones I have heard of? Day by day, the entire industry is hellbent on proving that open-weights and self-hosting is the only safe…
-
Is it naive to assume that the agent will try and access anything on your disk, either accidentally or maliciously?Permissions classifiers in auto mode are just models trying to guess if they're doing the right thing.Claude Code will tell you that it went around a sandbox because the sandbox blocked it. At which point, you ask yourself the point…
-
Huh - anyone recall other examples of open sourcing a product code base to mitigate a user trust issue? (In 2026 it's perhaps less powerful because "you're just going to feed it to some AI tool anyway" but I think it's an interesting attempt to make and I don't think I've seen it before...)
-
Things like that - and other examples posted here - are why I 'm sticking with OpenCode despite it having some papercuts that annoy me.The incentives are not there for them to do shady stuff like vacuum your files, inflate your token count just because or many other things.
-
Never use a Harness if it is not opensourced.DeepSeek Harness is my favorite for coding. Hermes is my favourite for Other things , followed by OpenCode (sucks at managing long running services) .Others swear by Pi.dev
-
There had to be a catch to the "free" promotion they're offering this month if you use ZCode. Glad my instinct to isolate it helped me, but I feel sorry for anyone whose secrets, etc. got vacuumed up by Ziphu
-
Envelope encryption with server-held private keys turns local backup into remote asset extraction.
All 2 developments of Developer reveals ZCode silently uploads encrypted Git… →
Hacker NewsMastodonNewswires