conv.

← The whole story
Security
Developer reveals ZCode silently uploads encrypted Git history to Z.ai's cloud

Upload pipeline runs automatically with no user-facing toggle

1 Sep 18 2:11 AM · 7d ago · 1 post · 1 source · development 1 of 2

The capture/upload sidecar is instantiated unconditionally at startup whenever the user is logged in. There are no UI settings to disable it—the only requirement is a valid JWT from the tokenProvider. Capture triggers occur before every prompt and on task completion, with a single session generating up to 62 capture events.

Upload pipeline runs automatically with no user-facing toggle
tokenstead.ai

“A key that only the server can use serves exactly one purpose: making sure the server can read your code whenever it wants.”

ferstar, Security researcher · hn ↗

ferstar Security researcherZ.ai (Zhipu) Developer of ZCode and GLM modelsPetri Kuittinen Open-source AI agent developerFeiZ Chinese developer/community member

The whole story articlesposts the bright band is this development · numbered dots are the others · click one to jump

Peak 5 pieces in two hours at Sep 18, 6 AM; 26 pieces over 7 days (4 articles · 8 posts · 14 comments) Sep 18, 2 AM — 4 pieces · 2 articles · 1 post · 1 comment — Newswires 2, Hacker News 2Sep 18, 4 AM — 1 piece · 1 comment — Hacker News 1Sep 18, 6 AM — 5 pieces · 2 articles · 2 posts · 1 comment — Newswires 2, Hacker News 2, Mastodon 1Sep 18, 8 AM — 4 pieces · 4 comments — Hacker News 4Sep 18, 10 AM — 2 pieces · 1 post · 1 comment — Hacker News 1, Mastodon 1Sep 18, 12 PM — 3 pieces · 1 post · 2 comments — Hacker News 2, Mastodon 1Sep 18, 2 PM — 2 pieces · 1 post · 1 comment — Hacker News 1, Mastodon 1Sep 18, 4 PM — 1 piece · 1 comment — Hacker News 1Sep 18, 6 PM — quietSep 18, 8 PM — 1 piece · 1 comment — Hacker News 1Sep 18, 10 PM — 1 piece · 1 post — Mastodon 1Sep 19, 12 AM — quietSep 19, 2 AM — quietSep 19, 4 AM — quietSep 19, 6 AM — quietSep 19, 8 AM — quietSep 19, 10 AM — quietSep 19, 12 PM — quietSep 19, 2 PM — quietSep 19, 4 PM — quietSep 19, 6 PM — 1 piece · 1 comment — Hacker News 1Sep 19, 8 PM — quietSep 19, 10 PM — quietSep 20, 12 AM — quietSep 20, 2 AM — quietSep 20, 4 AM — quietSep 20, 6 AM — quietSep 20, 8 AM — quietSep 20, 10 AM — quietSep 20, 12 PM — quietSep 20, 2 PM — quietSep 20, 4 PM — quietSep 20, 6 PM — 1 piece · 1 post — Hacker News 1Sep 20, 8 PM — quietSep 20, 10 PM — quietSep 21, 12 AM — quietSep 21, 2 AM — quietSep 21, 4 AM — quietSep 21, 6 AM — quietSep 21, 8 AM — quietSep 21, 10 AM — quietSep 21, 12 PM — quietSep 21, 2 PM — quietSep 21, 4 PM — quietSep 21, 6 PM — quietSep 21, 8 PM — quietSep 21, 10 PM — quietSep 22, 12 AM — quietSep 22, 2 AM — quietSep 22, 4 AM — quietSep 22, 6 AM — quietSep 22, 8 AM — quietSep 22, 10 AM — quietSep 22, 12 PM — quietSep 22, 2 PM — quietSep 22, 4 PM — quietSep 22, 6 PM — quietSep 22, 8 PM — quietSep 22, 10 PM — quietSep 23, 12 AM — quietSep 23, 2 AM — quietSep 23, 4 AM — quietSep 23, 6 AM — quietSep 23, 8 AM — quietSep 23, 10 AM — quietSep 23, 12 PM — quietSep 23, 2 PM — quietSep 23, 4 PM — quietSep 23, 6 PM — quietSep 23, 8 PM — quietSep 23, 10 PM — quietYesterday, 12 AM — quietYesterday, 2 AM — quietYesterday, 4 AM — quietYesterday, 6 AM — quietYesterday, 8 AM — quietYesterday, 10 AM — quietYesterday, 12 PM — quietYesterday, 2 PM — quietYesterday, 4 PM — quietYesterday, 6 PM — quietYesterday, 8 PM — quietYesterday, 10 PM — quietToday, 12 AM — quietToday, 2 AM — quietToday, 4 AM — quietToday, 6 AM — quietToday, 8 AM — quietToday, 10 AM — quiet 1–2
1–2Upload pipeline runs automatically with…
Sep 19Sep 20Sep 21Sep 22Sep 23yesterdaynow · 11:08 AM ET

Reported in the same hours no headline names this development itself — these 1 claim were published in its stretch

  1. 2 outlets Inside ZCode: Silently uploading your Git history to the cloud

    first by HN Best, 7d ago · also HN Frontpage

What people said 1 voice · verbatim

All 2 developments of Developer reveals ZCode silently uploads encrypted Git… →

Hacker NewsMastodonNewswires