ZCode, the GLM coding agent, silently uploads your Git history

9 relevance

Critical security flaw in AI coding agent, immediate concern for anyone using such tools.

AI/ML tokenstead.ai

Answer the board on AI readiness

Arrive with evidence, not opinion. See how your foundation benchmarks against your peers, get a clear read, and leave with a ranked place to start.

Why It Matters

For engineers building on local AI or using closed-source coding agents, this demonstrates that the harness layer can silently exfiltrate years of engineering history (including deleted secrets, unreleased plans, and internal configs) without user control, undermining any assumption of privacy from model weight openness.

Key Takeaways

Inspect every closed-source AI harness for network and file-access behavior before using it in any workspace containing sensitive git history or credentials.

ZCode, the GLM coding agent, silently uploads your Git history

Summary

ZCode, the closed-source GLM coding agent from Z.ai, silently encrypts and uploads the user's entire workspace—including full .git history, reflogs, and LFS assets—to Alibaba Cloud OSS using envelope encryption (AES-256-CTR with RSA-OAEP key wrapping where the private key lives only on Z.ai's servers). A reverse-engineering walkthrough by developer ferstar showed a 313MB archive from a 345MB workspace, with the .git directory comprising 86.6% of the payload, and that no toggle settings prevent the upload. The incident drew over 276,000 views and widespread calls not to trust closed-source AI harnesses, especially since GLM's open weights lead many to wrongly assume the runtime is also open.

Author

Tokenstead