Z.ai's ZCode agent silently uploads full Git history, researcher's teardown claims

What the teardown claims

A developer publishing as ferstar posted a reverse-engineering walkthrough of ZCode on September 18, 2026, hosted on tokenstead.ai and surfaced through Hacker News. ZCode is the desktop coding agent from Z.ai, the Beijing-headquartered company behind the GLM family of open-weight models. According to the walkthrough, a logged-in client silently assembles an archive of the user's entire workspace — the complete .git directory, the LFS asset cache, reflogs and global app configs — encrypts it, and uploads it to Aliyun OSS, Alibaba Cloud's object storage.

On the researcher's machine, the app produced a 313MB encrypted archive from a 345MB commercial workspace of 42,411 files, and its logs recorded 564 failed upload attempts while the behavior was under investigation. A plaintext manifest stored locally shows how lopsided the payload is: the .git directory made up 86.6 percent of the archive — 196.1MB of LFS assets, 102.2MB of git objects and 0.6MB of logs — versus 46.2MB of working-tree source and documentation.

A key only the vendor holds

The detail that turned a suspicious directory into a story is the key management. Per ferstar's reconstruction from the client's app.asar, the app requests upload credentials from zcode.z.ai and receives OSS form signatures, an object key, a size cap and a per-round RSA public key. It then packs the workspace as tar.gz, encrypts it with AES-256-CTR, wraps the symmetric key with RSA-OAEP using the server-supplied public key, and POSTs the result directly to Aliyun OSS, with a callback registering the snapshot on Z.ai's backend.

The matching private key exists only in Z.ai's cloud. Ferstar reports failing to unwrap the archive with every private key present on the local system, meaning neither the user nor the client itself can read the ciphertext sitting on the user's own disk. As the researcher put it: "A key that only the server can use serves exactly one purpose: making sure the server can read your code whenever it wants."

Settings do not disable it

Cross-referencing the UI against the code, ferstar found that "Optimize Experience" (optimizeAgentExperienceEnabled) only controls whether collected data may be used for model training, and "Repo Snapshot Indexing" (repoSnapshotIndexingEnabled) only controls whether the server indexes what was already uploaded. Local capture and upload continue either way. The capture sidecar is instantiated unconditionally at startup, gated only on the client producing a valid auth token, and a single active session logged 62 capture events — triggered before every prompt and again at task completion.

Corroboration comes from OrcaPromptVault, a public archive of captured agent prompts, which holds ZCode's 131KB system prompt and its 31-tool surface. That tool list contains no snapshot, upload or telemetry tool at all: the pipeline runs as a host-level sidecar outside the agent's tool loop, which is why no permission prompt ever fires and the agent itself never reports it. The captured surface does include a ReadSessionContext tool that can pull other persisted ZCode sessions by ID.

Disclosure gap and reaction

According to the walkthrough, ZCode's privacy policy discloses only "text, files, and code submitted during conversations," and ferstar found no mention of packaging and uploading whole workspaces in the policy, FAQ or changelog. That sits awkwardly with the app's July 2026 launch, which leaned on trust: a Z.ai executive had said on X that the company would implement nothing beyond what the website lists — and workspace snapshotting is not listed.

Z.ai, publicly traded in Hong Kong since January 2026, had not officially responded at publication time. The most visible reply, from an account affiliated with the ZCode team — "hey I am sorry to let you find it" — reads as confirmation rather than rebuttal. Deleting the pending archive does not help: the client reportedly rebuilt a fresh 313MB package within half an hour and kept retrying.

The post drew 276,000 views within 13 hours, and a Chinese-language alert thread by FeiZ added another 63,800, urging users to disable ZCode for now and favor open-source agents.

Why it matters

A git object store is not a copy of your working tree; it is the repository's full lineage. API keys deleted in later commits, unpushed branch names hinting at unreleased products, internal hostnames and paths from .git/config — all of it travels in the archive. The episode also exposes a live confusion in the local-AI community: GLM's weights are open, but ZCode is closed, and several commenters assumed otherwise because of the model's reputation. As Petri Kuittinen, who open-sources his own agent with security documentation, put it: "My advice has been and continues to be: do NOT trust closed source AI harnesses." These findings remain one researcher's reverse-engineering, unanswered by Z.ai — but they are a reminder that the trustworthiness of a local-model setup depends on the harness running it, not just the weights.