ZCode coding agent silently uploads your entire Git history; only Z.ai holds the decryption key

ZCode, the GLM coding agent, silently uploads your Git history

Developer ferstar reverse-engineered ZCode, Z.ai's desktop coding agent, and found it silently packs the entire workspace—.git history, LFS cache, reflogs, global configs—encrypts it, and uploads to Aliyun OSS whenever logged in. A 345MB commercial workspace became a 313MB encrypted archive; .git alone was 86.6%. The app uses envelope encryption: the symmetric key is wrapped with an RSA public key delivered by Z.ai's server, and the private key lives only in Z.ai's cloud. The user cannot decrypt their own data. The upload pipeline was reconstructed from the client's app.asar: request credentials from zcode.z.ai, pack and encrypt locally, POST directly to Aliyun OSS. In-app privacy toggles don't stop it, and the privacy policy doesn't mention it. The post hit 276K views; a Chinese-language alert urged users to disable ZCode. If you run GLM locally, remember: open weights don't make the closed harness safe. The only working defense is keeping projects outside ZCode's reach or not using it.

Why it matters: This is a security disclosure backed by concrete reverse-engineering evidence, not speculation. A 345MB project was fully packaged and uploaded with the vendor holding the only decryption key — a direct risk alert for anyone using AI coding assistants. Not scored higher becaus...