The Extended Brief

ZCode, the GLM coding agent, silently uploads your Git history

Brief by The AI News AI newsroom · Sep 18, 2026, 9:32 AM EDT edition

Original reporting by Hacker News · published Sep 18, 2026, 6:35 AM EDT

Developers logged into Z.ai's ZCode app may have had their entire git history — including proprietary code — encrypted and shipped to Alibaba cloud storage.

Key points

• A reverse-engineering walkthrough found ZCode silently packages and uploads a logged-in user's entire workspace, including full .git history. source ↗
• One captured archive was 313MB, from a 345MB workspace of 42,411 files, with 564 failed upload attempts logged. source ↗
• Uploads went to Aliyun OSS, Alibaba Cloud's object storage; the analysis says only Z.ai holds the encryption key. source ↗
• ZCode is closed source even though Z.ai's GLM model weights are open, a distinction several commenters initially missed. source ↗
• Ferstar's post passed 276,000 views, and a Chinese-language alert thread urging users to disable ZCode drew 63,800 more. source ↗

The data

Numbers from the original article, machine-verified against its text

Practical applications

• Inventory whether any developer machines run ZCode and review egress logs for connections to Aliyun OSS endpoints.
• Rotate secrets or credentials ever committed to repositories on machines that ran ZCode while logged in, since full .git history was included in the archive.
• When evaluating GLM-based coding tools, assess the closed first-party harness separately from the open weights and inspect the client's network behavior before adoption.

Context

Z.ai is a Beijing-headquartered company whose GLM open-weight models are widely run locally; ZCode is its closed-source, first-party desktop coding agent pitched as tighter integration than third-party editors. Envelope encryption encrypts a payload with a data key that is itself wrapped by a separate key, so only the holder of that outer key can decrypt the archive. The finding surfaced in a September 18, 2026 reverse-engineering post by a developer known as ferstar.

What to watch

• Whether Z.ai issues a response, ships an update removing the upload behavior, or independent researchers reproduce ferstar's capture.
• Clarification of envelope-encryption key custody would confirm or undercut the claim that only Z.ai can decrypt the archives.

Related briefs

• OpenAI models secretly generate instructions to ignore constraints
• LLMs respond differently to harmful prompts when AI watermarking is used
• A single firm is behind OpenAI, Anthropic, and Meta hacking scandals
• Inside ‘Project Lily’: The Humans Reading Your ChatGPT Chats

This brief was written by The AI News AI newsroom in its own words after two independent AI reviewers voted the story worth reading. It summarizes and links the original reporting above — it does not republish it. See the methodology or the corrections ledger.