On September 18, 2026, a developer going by ferstar published a reverse-engineering walkthrough of ZCode, the AI coding desktop app from Z.ai, the Beijing-headquartered business rearward the GLM family of open-weight models - the identical models operating on local rigs all complete the local-AI community, including GLM-5.3-Flash, tracked on this site. The finding says worse than most privacy scandals: whenever the app is logged in, it silently packages the user’s complete workspace - complete .git history, LFS asset cache, reflogs, and earth app configs - encrypts it, and uploads the archive to Aliyun OSS, Alibaba Cloud’s entity storage. The researcher’s own capture: a 313MB encrypted archive built from a 345MB business workspace, 42,411 files, alongside 564 unsuccessful upload attempts logged during the investigator investigated.
If you run GLM locally, the business that publishes the weights is not the identical item as the runtime a developer power use on top of them - and the thread reply showed the disturbance is live: multiple commenters assumed ZCode was open origin since GLM is. It is not. The weights are open; the harness is closed, and it is Z.ai’s harness for its own models, thrown as first-party integration no third-party publishing company can match.
The narrative dispersed in the two languages inside hours: ferstar’s article passed 276,000 views, and FeiZ’s Chinese-language vigilant thread (“disable ZCode for now… it’s motionless finest to use open-source agents as much as possible”) drew another 63,800. The most quoted reply came from Petri Kuittinen, whose own AI delegate is open originated alongside safety documentation: “My direction has been and continues to be: do NOT rely closed origin AI harnesses.”
The item that turned a doubtful directory into a story: the encryption key. ZCode uses letter cover encryption - the payload is encrypted alongside a symmetric key, and that key is wrapped alongside an RSA-OAEP community key. The community key is delivered by the server during upload-credential negotiation. The corresponding personal key lives lone in Z.ai’s cloud. ferstar attempted to unwrap the archive alongside all personal key on the local scheme and failed. The 313MB ciphertext sitting on the user’s own disk cannot be decrypted by the person or by the ZCode client itself.
ferstar’s conclusion, from the post: “A key that lone the server can use serves exactly one purpose: making certain the server can peruse your code whenever it wants.”
What gets packed
The packaging manifest is stored locally in plaintext, and it is specific. For a 42,411-file snapshot:
| Content | Size | Share |
|---|---|---|
| .git/lfs/ | 196.1 MB | 56.8% |
| .git/objects/ | 102.2 MB | 29.6% |
| .git/logs/ | 0.6 MB | 0.2% |
| Source code and docs | 46.2 MB | 13.4% |
The .git directory solitary is 86.6 percent of the payload.
Payload breakdown of one 42,411-file snapshot: the .git directory is 86.6 percent of the encrypted archive. ::: That matters since a git entity shop is not a snapshot of your operating tree - it is the complete lineage of the repository since day one. Deleted-in-a-later-commit API keys are in there. Unpushed branch names that disclose unreleased merchandise plans are in there. Internal hostnames and repo paths from .git/config are in there. A captured archive is years of engineering history, not the records you had open. The upload pipeline, reconstructed from the client’s app.asar: the client requests credentials from zcode.z.ai, which returns OSS form signatures, an entity key, a size cap, and a per-round RSA community key; the client packs the workspace to tar.gz, encrypts alongside AES-256-CTR, wraps the symmetric key, and POSTs the archive immediately to Aliyun OSS, which callbacks to Z.ai’s backend to enroll the snapshot. The operating client maintained persistent connections to zcode.z.ai and two Aliyun OSS nodes during the test. :::figure /images/articles/zcode-git-upload/upload-flow.svg The reconstructed ZCode snapshot upload flow: credentials from the coordinator, local packing and encryption, straightforward form POST to Aliyun OSS, recall registration. Reconstructed from the client app.asar by ferstar.
The toggles do not halt it
The natural move is beginning settings. ferstar cross-referenced the UI switches against the code:
- “Optimize Experience” (optimizeAgentExperienceEnabled) lone controls whether data is authorized for example training. Snapshot grasp and upload continue.
- “Repo Snapshot Indexing” (repoSnapshotIndexingEnabled) lone controls whether the server indexes uploaded snapshots. Local packaging and upload continue.
The presenter gathering instantiates the grasp sidecar unconditionally at startup, alongside no gating on person preferences - the lone necessity is that the token provider can create a valid JWT. Session logs showed 62 grasp events from a sole energetic session, triggered before all immediate and on project completion.
A second origin corroborates the mechanism. OrcaPromptVault, a community gathering of captured AI harness prompts, holds a 131KB scheme immediate and a 31-tool exterior from ZCode. The checkpoint/rewind characteristic is wired into the scheme immediate - the template “Workspace rewind applied. rewindId, checkpointId, strategy, restoredFiles” appears five times. This is the user-facing tip of the snapshot pipeline, the characteristic the filesystem fastener disables.
The agent’s complete tool exterior contains zero snapshot, upload, or telemetry tools. The exfiltration pipeline is not an delegate tool; it is a host-level sidecar instantiated exterior the tool loop. That is why no approval environment stops it, and why the delegate itself never sees it. Across 131KB of captured instructions there is no citation of Aliyun, OSS, uploads, or privacy.
The grasp adds a item ferstar did not mention: ZCode ships a ReadSessionContext tool that says another persisted ZCode sessions on petition by meeting ID. Combined alongside the host-level snapshot sidecar, meeting satisfied is the two locally persisted and cloud-captured.
The leaked scheme prompt’s checkpoint template (appears five times) and the agent’s 31-tool surface, which contains no snapshot, upload, or telemetry tools.
The privacy guideline does not citation it
ZCode’s privacy guideline states the tool collects “text, files, and code submitted during conversations” - the norm inference-context disclosure all AI coding tool makes. Across the policy, FAQ, and changelog, ferstar established no citation of packaging and uploading complete workspaces and git histories. The closest row is a template declaration concerning the optimization program being off by default.
The environment that makes it worse
ZCode launched in July 2026, and its initiate throw ran immediately on trust. Z.ai positioned the harness against Anthropic’s Claude Code weeks following the Claude Code hidden-telemetry controversy, alongside open weights positioned as the escape from the kill-switch problem. A Z.ai executive, asked on X whether ZCode would contain “any kind of spyware,” answered that the business would not execute “anything beyond what’s listed” on the ZCode website.
Workspace snapshotting is not listed on the ZCode website.
Z.ai went community on the Hong Kong Stock Exchange in January 2026. The company’s authoritative X document had not responded to ferstar’s article as of publication. The most apparent answer came from an document affiliated alongside the ZCode squad - “hey I am apologetic to let you discover it” - which says as confirmation of the mechanism, not a rebuttal of it. ferstar’s tweet passed 276,000 views inside 13 hours, and conversation threads on V2EX and HN-adjacent channels divided mostly alongside one line: agents upload code fragments during tool calls all the time, alongside consent. This is a complete repository affirmative its complete history, without consent, encrypted so lone the vendor can peruse it.
The defence that works
Deleting the pending archive does not work: the client re-packaged a caller 313MB archive inside fractional an hour, retry oppose incrementing. The fix that holds is filesystem-level. Make the checkpoints directory unwritable at the kernel level:
Linux:
rm -rf ~/.zcode/v2/checkpoints mkdir -p ~/.zcode/v2/checkpoints sudo chattr +i ~/.zcode/v2/checkpoints
macOS:
rm -rf ~/.zcode/v2/checkpoints mkdir -p ~/.zcode/v2/checkpoints chflags uchg ~/.zcode/v2/checkpoints
The trade: the checkpoint rollback UI stops operating - a characteristic that required uploading your code in the archetypal place. Chat, autocomplete, and tool calls activity normally. Restore alongside chattr -i or chflags nouchg.
What it method for local
Running open weights locally is the pitch: your model, your hardware, no per-token bill, no vendor switch-off. The ZCode narrative sharpens the item former the example layer. The runtime about the example - the harness, the desktop app, the update pipeline - is part of the rely surface, and a locally-running example wrapped in a cloud-phoning harness is not local.
Two checks prosecute from this, and they use to all harness in this space, not lone ZCode: what does the runtime transmit whenever you are logged in, and who can decrypt what it stores. Tokenstead tracks delegate harnesses and their telemetry behavior for exactly this reason; this part volition be updated if Z.ai responds alongside a fix, a disclosure change, or a statement.
Sources:
- Inside ZCode: Silently Uploading Your Entire Git History to the Cloud - ferstar, September 18, 2026 (full forensics: asar reconstruction, encryption flow, manifest breakdown)
- ferstar on X - the summary thread, 276K views
- FeiZ on X - Chinese-language vigilant thread, 63.8K views
- ZCode releases and changelog - Z.ai official
- V2EX conversation thread - community response, Chinese
- lookonchain coverage
