ZCode, the GLM coding agent, silently uploads your Git history

TL;DR Highlight

Logged-in ZCode silently encrypts and uploads your whole .git history to the cloud

Who Should Read

A developer who connects private repos to AI coding agents or desktop apps and worries about code leaking

Core Mechanics

Logging in uploads the whole workspace
- Per the article, ZCode packs .git history, LFS cache, reflogs and app configs, encrypts them and uploads to Aliyun OSS.
- The captured case was a 313MB encrypted archive from a 345MB workspace with 42,411 files.
86.6% of the payload is .git
- .git/lfs is 196.1MB (56.8%), .git/objects 102.2MB (29.6%), source and docs 46.2MB (13.4%).
- Git objects retain API keys deleted in later commits, unreleased branch names and internal hostnames.
Only Z.ai's server holds the key
- The payload key is wrapped with an RSA-OAEP public key delivered by the server.
- The private key lives only in Z.ai's cloud, and the researcher failed to decrypt with every local private key.
Turning off the toggles doesn't stop it
- "Optimize Experience" only controls authorization for model training.
- "Repo Snapshot Indexing" only controls server indexing, while local packaging and upload continue.

Community Reactions

Comment questions the article's framing
- One commenter noted the thread was an LLM paraphrase of the original post.
- Another argued the article confuses git log with the whole git repository.
A comparison claim appeared
- One commenter claimed Claude also uploads git history (git log) to Anthropic daily.
- No evidence was given in the comment.
A dismissive reaction too
- One joking comment said people are making a fuss and that the company doesn't even use its own products.

How to Apply

Lock the checkpoints directory to block uploads
- If you use ZCode today, recreate ~/.zcode/v2/checkpoints and set chattr +i (Linux) or chflags uchg (macOS).
- The checkpoint rollback UI will stop working.
Add two questions to your agent tool checklist
- Check what the runtime transmits while logged in.
- Check who can decrypt the data it stores.
Don't use closed harnesses on sensitive repos
- Move repos with keys or internal hosts in history to an open-source agent.
- Add possibly exposed keys to your rotation list.

Try It

copy & run

# Paste in shell (Linux). On macOS, replace the last line with: chflags uchg ~/.zcode/v2/checkpoints

rm -rf ~/.zcode/v2/checkpoints
mkdir -p ~/.zcode/v2/checkpoints
sudo chattr +i ~/.zcode/v2/checkpoints

# Undo: sudo chattr -i ~/.zcode/v2/checkpoints (macOS: chflags nouchg)

Terminology

envelope encryptionLock data with key A, then lock key A with key B and store it. Like putting the box key inside a safe.

RSA-OAEPA scheme where a public key locks and only the private key unlocks. Like a mailbox anyone can drop into but only the owner opens.

harnessThe runtime around a model that provides file access, tool calls and UI. If the model is the engine, the harness is the body.

sidecarA helper process running alongside the main app. Here it runs outside the agent's tool list, so the agent never sees it.

reflogA git log of where branch pointers have moved. Even deleted commits can often be found there.