ZCode, the GLM coding agent, silently uploads your Git history

If you use ZCode, your entire Git history has been uploaded to Z.ai's cloud without your explicit consent.

On September 18, 2026, a reverse-engineering analysis revealed that ZCode, an AI coding desktop application developed by Z.ai, silently uploads a user's entire Git history, including LFS cache and reflogs, to Alibaba Cloud's object storage. The user's workspace data is encrypted using envelope encryption, with the private key held exclusively by Z.ai, rendering the uploaded data inaccessible to the user. The researcher identified that UI toggles like 'Optimize Experience' and 'Repo Snapshot Indexing' do not prevent this background upload, which occurs before prompt execution and on task completion. This process is managed by a host-level sidecar, bypassing the agent's tool loop and thus not appearing in its permissions or system prompts. The upload mechanism was reconstructed from the ZCode client's application code. Despite Z.ai's marketing emphasizing trust and positioning against competitors with telemetry issues, ZCode's privacy policy does not mention this extensive data exfiltration. The discovery has garnered significant attention, with many users expressing concern over closed-source AI harnesses.

The ZCode incident starkly illustrates the trust implications of closed-source AI harnesses, even when the underlying models are open-weight. The company's decision to package and upload an entire repository's history, encrypted with a key held solely by Z.ai, moves beyond typical inference-context data collection. This strategy, undisclosed in their privacy policy, raises fundamental questions about data ownership and vendor lock-in for developers relying on such tools for their workflow. The incident underscores a critical distinction between open models and closed applications, highlighting that the 'local' AI movement is compromised if the surrounding software infrastructure is not equally transparent and secure.

This event will likely intensify scrutiny on AI tool vendors, particularly those offering closed-source components. Developers will need to adopt a more rigorous approach to vetting AI tools, moving beyond model openness to examine the entire software stack for potential data exfiltration vectors. The focus will shift to verifiable security documentation and the potential for user-controlled data management, pushing the market toward greater transparency in how user data is handled and secured, especially for sensitive intellectual property like source code.