Developer reveals ZCode silently uploads encrypted Git history to Z.ai's cloud
A reverse-engineering analysis shows Zhipu's AI coding app packages and encrypts entire workspaces—including deleted code and API keys—without user control.
What to know
- ZCode, Zhipu's official AI coding app, automatically uploads entire Git repositories—including deleted code, API keys, and branch metadata—to Alibaba Cloud whenever the user is logged in.
- The uploads are encrypted with a private key held only by Z.ai's servers, meaning users cannot decrypt the 300MB+ archives stored on their own disks.
- The upload pipeline runs automatically with no user-facing toggle or privacy setting to disable it.
- The finding triggered rapid spread across English and Chinese developer communities, with security researchers warning against closed-source AI coding tools.
Closed-source AI coding tools pose unacceptable security and privacy risks; users should switch to open-source alternatives.
-
“My advice has been and continues to be: do NOT trust closed source AI harnesses.”
Petri Kuittinen · Hacker News (quoted in coverage) ↗
Confusion between open-weight models and proprietary applications; users incorrectly assumed ZCode was open source because GLM is.
-
“several commenters assumed ZCode was open source because GLM is”
Coverage observation · Hacker News thread (quoted in coverage) ↗
ferstar Security researcherZ.ai (Zhipu) Developer of ZCode and GLM modelsPetri Kuittinen Open-source AI agent developerFeiZ Chinese developer/community member
How it unfolded 2 developments, newest first · click a bar or a number to jump articlesposts
-
2
Story spreads to 276,000+ views; security researcher issues warning
Ferstar's original post reached 276,000 views within hours. A Chinese-language alert thread by FeiZ drew 63,800 views. Petri Kuittinen, developer of an open-source AI agent, issued a widely quoted warning against closed-source AI tools.
“My advice has been and continues to be: do NOT trust closed source AI harnesses.”
— Petri Kuittinen -
T
Researcher ferstar reverse engineered ZCode, the closed-source AI coding desktop app from Z.ai (maker of the GLM model family), and found that while a user is logged in it silently packages their entire workspace, including full Git history, LFS cache, and reflogs, encrypts it, and uploads it to Aliyun OSS. The archive uses envelope encryption in…
2 more of the top 3 · 14 posts in this stretch
-
I was wondering if I should try to create my own pseudo filesystem with FUSE for easy copy-on-write/snapshots, a native feel, and automated secrets filtering/swapping. I might as well combine that with good/easy isolation.The whole “what sandbox/VM/microVM/thing is best?” question has been bugging me a lot lately, and I no longer trust any of…
-
z.ai made a statement, screenshotted in this article: https://finance.sina.com.cn/tech/roll/2026-09-18/doc-inisfye...claude translation:Dear ZCode users,We take today's community discussion very seriously. We carried out an internal review right away, and we first want to apologize to the affected users. Here is an explanation of what happened:The…
-
-
1
Upload pipeline runs automatically with no user-facing toggle
The capture/upload sidecar is instantiated unconditionally at startup whenever the user is logged in. There are no UI settings to disable it—the only requirement is a valid JWT from the tokenProvider. Capture triggers occur before every prompt and on task completion, with a single session generating up to 62 capture events.
“A key that only the server can use serves exactly one purpose: making sure the server can read your code whenever it wants.”
— ferstar, Security researcher · source -
They learned nothing from the Grok Code saga.If anything, that should have been a learning lesson to NOT trust harnesses, especially new ones.
-
-
background
Uploads capture complete Git history, not just current working files — The encrypted archives contain the full lineage of repositories since day one, including deleted-in-later-commits API keys, unpushed branch names revealing unreleased product plans, and internal hostnames from .git/config. The .git directory comprises 86.6% of the 313MB encrypted archive from a 42,411-file snapshot.
-
background
ZCode uses server-held encryption keys that users cannot decrypt — The app uses envelope encryption: the payload is encrypted with AES-256-CTR, and the symmetric key is wrapped with an RSA-OAEP public key delivered by Z.ai's servers. The private key lives only in Z.ai's cloud. Ferstar confirmed that the 313MB ciphertext on disk cannot be decrypted by the user or the ZCode client itself.
-
background
Ferstar publishes reverse-engineering analysis of ZCode's upload pipeline — Researcher ferstar discovered that ZCode automatically packages and encrypts the entire workspace—including .git history, LFS asset cache, reflogs, and global configs—and uploads it to Aliyun OSS. The researcher found a 313MB encrypted archive and reconstructed the full upload flow by examining the app.asar client bundle.
Also covered reported alongside — the timeline has no entry for these yet
-
first by HN Best, 6d ago · also HN Frontpage
-
first by HN Best, 6d ago · also HN Frontpage
What people are saying 11 voices from 1 site · best of 15 · verbatim
- Sep 18
-
Envelope encryption with server-held private keys turns local backup into remote asset extraction.
-
Huh - anyone recall other examples of open sourcing a product code base to mitigate a user trust issue? (In 2026 it's perhaps less powerful because "you're just going to feed it to some AI tool anyway" but I think it's an interesting attempt to make and I don't think I've seen it before...)
-
Is it much different from Apple and Google who trick user into agreeing and upload all user's data into a US cloud for convenient LE access?Also, as I understood, this is a feature to allow server-side indexing of the project. But of course I wouldn't run this, and I generally wouldn't run any IDE or AI tools without a sandbox.Sadly this plague of…
-
Evidently there's not a single inference provider that can be trusted. This is why I don't use OpenRouter either. How am I supposed to trust all of those random providers I've never heard of, when I can't even trust the ones I have heard of? Day by day, the entire industry is hellbent on proving that open-weights and self-hosting is the only safe…
-
Things like that - and other examples posted here - are why I 'm sticking with OpenCode despite it having some papercuts that annoy me.The incentives are not there for them to do shady stuff like vacuum your files, inflate your token count just because or many other things.
-
While we're on this, I find it really really weird how windows defender insists on sending my codex work files for analysis all the time (which I block in automatic permissions so it has to ask me in a notification). I don't think i've seen it ask to upload more than one or two things, and it doesn't do it with other AI app I use (eg Claude Code)…
-
Is it naive to assume that the agent will try and access anything on your disk, either accidentally or maliciously?Permissions classifiers in auto mode are just models trying to guess if they're doing the right thing.Claude Code will tell you that it went around a sandbox because the sandbox blocked it. At which point, you ask yourself the point…
-
Never use a Harness if it is not opensourced.DeepSeek Harness is my favorite for coding. Hermes is my favourite for Other things , followed by OpenCode (sucks at managing long running services) .Others swear by Pi.dev
-
Tangential, mildly amusing thing I noticed while implementing my own harness: GLM and particularly Deepseek are both fond of trying to read dotfiles and anything listed in your .gitignore files. I only noticed it because I have separate read scopes for project files, ignored files, dotfiles and external files, so the latter three always prompt me…
-
Lots of modern software plays it loose with privacy, but this IMO crossing a second line: doing so with zero notification whatsoever, in a massively intrusive way, against data that is almost certainly private and possibly illegal to exfiltrate, with no obvious way to turn it off.That crosses into outright malware.Makes me not want to use GLM or…
-
There had to be a catch to the "free" promotion they're offering this month if you use ZCode. Glad my instinct to isolate it helped me, but I feel sorry for anyone whose secrets, etc. got vacuumed up by Ziphu