Your AI Coding Agent Might Be Uploading Your Entire Git History

When Your Coding Agent Becomes a Data Pipeline You Didn't Approve

If your team has adopted an AI coding agent in the past year, you've made a trust decision most people never think to interrogate: what does this thing send home, and who holds the key to read it? A reverse-engineering report published on September 18 by a developer known as ferstar gives a stark answer for ZCode, the desktop coding agent from Z.ai — the company behind the widely used, open-weight GLM models. Whenever ZCode is logged in, it silently packages a user's entire workspace, including full Git history, and uploads it to the cloud, encrypted with a key only Z.ai holds. The story passed 276,000 views on X within 13 hours and hit the Hacker News front page twice, with independent write-ups from Tokenstead and RuntimeWire corroborating the core findings.

What ZCode Actually Uploads

Ferstar found the evidence by accident, while clearing disk space: a 313MB encrypted archive sitting in ZCode's local data folder, built from a 345MB commercial workspace containing 42,411 files. A plaintext packaging manifest showed exactly what was inside. The .git directory alone accounted for 86.6% of the payload — 196.1MB of Git LFS data and 102.2MB of Git objects, against just 46.2MB of actual source code and docs.

That distinction matters more than it sounds. A Git object store isn't a snapshot of the files you have open — it's the complete lineage of a repository since day one. Credentials deleted in a later commit are still in there. Unpushed branches revealing unreleased product plans are in there. Internal hostnames from .git/config are in there. Capturing that history is capturing years of engineering decisions, not a working directory.

The Encryption Only Z.ai Can Undo

The detail that turned this from "AI tools upload some context" into a genuine controversy is the key management. ZCode uses envelope encryption: it compresses the workspace, encrypts it with AES-256-CTR, then wraps that symmetric key with an RSA public key delivered fresh by Z.ai's server during each upload. The matching private key never touches the user's machine — it lives exclusively in Z.ai's cloud. Ferstar tried every private key on the test system and confirmed none could unwrap the archive. As ferstar put it: "A key that only the server can use serves exactly one purpose: making sure the server can read your code whenever it wants."

The Privacy Toggles That Don't Do Anything

Naturally, the first instinct is to check settings. Ferstar cross-referenced ZCode's two visible privacy toggles against its actual code. "Optimize Experience" only controls whether content is used for model training — it doesn't touch the upload pipeline. "Repo Snapshot Indexing" only controls whether the server indexes what's already been uploaded — packaging and transmission continue regardless. The capture mechanism starts automatically the moment the app has a valid login token, firing before every prompt and after every task completion; one logged session recorded 62 capture events. ZCode's current privacy policy, meanwhile, discloses only that it collects "text, files, and code submitted during conversations" — standard inference-context language that never mentions packaging and uploading entire repository histories.

Why This Matters Beyond One Vendor

It's tempting to read this as a story about one company having a bad week. The more useful lesson is structural: open model weights and an open runtime are not the same guarantee. Z.ai publishes the GLM weights that run this story's model, but ZCode — the desktop application wrapped around those weights — is closed, and it's the application, not the model, that decides what leaves your machine. The same question applies to every coding agent an agency or automation team adopts, whether it's built on open or closed weights: what does the runtime transmit while you're logged in, and who holds the key to read it back?

For agencies building client work on top of AI coding tools, that question isn't academic. A client's proprietary codebase, sitting in your Git history, is exactly the kind of asset a vendor security review is supposed to catch before a tool gets anywhere near production repositories.

Key Takeaways

• A reverse-engineering report found ZCode, Z.ai's desktop coding agent, silently uploads full workspaces — 86.6% of it Git history — to Aliyun cloud storage whenever a user is logged in.
• The archive is encrypted with a key only Z.ai's servers hold, so neither the user nor the ZCode client itself can decrypt what's sitting on the user's own disk.
• Both of ZCode's visible privacy toggles govern training-data use and server-side indexing — neither stops the underlying packaging and upload pipeline.
• Open model weights don't guarantee an open or transparent runtime; the desktop application wrapped around a model is a separate trust surface with its own telemetry behavior.
• Before adopting any AI coding agent for client or production work, verify what the tool transmits while active and who can decrypt it — don't rely on a settings toggle or a privacy policy summary alone.

This is a developing story. As of publication, Z.ai's official account had not issued a public response beyond a brief acknowledgment from an account affiliated with the ZCode team.