Thread

ZCode, the GLM coding agent, silently uploads your Git history

260 points · 14 comments · cdnsteve

Loading the complete thread in the background. This saved snapshot is available now. Refresh

outloudvi · 1789731082 · focus · HN ↗
LLM-paraphrased from the original post: <a href="https://blog.ferstar.org/en/posts/zcode-silent-workspace-snapshot-upload/" rel="nofollow">https://blog.ferstar.org/en/posts/zcode-silent-workspace-sna...
1. Luc · 1789732074 · focus · HN ↗
  Indeed. Discussion here: <a href="https://news.ycombinator.com/item?id=49750694">https://news.ycombinator.com/item?id=49750694
  1. lucasoshiro · 1789736062 · focus · HN ↗
    Thanks. I'm upvoting that instead
  2. dang · 1789759073 · focus · HN ↗
    Ok, we've merged (most) comments moved thither. Thanks!
2. bbor · 1789748217 · focus · HN ↗
  So strange that this is still up 5 hours later… dang, I am yet again begging you to stop trying to roll your own forum ethos. It’s okay. You’re safe now. We can modernize without losing the magic. I know I know, shh, it’s okay, don’t worry, just flip the markdown and automod switches I know you have…
  (<3)
3. xdavidliu · 1789751297 · focus · HN ↗
  I made it about two paragraphs in the paraphase before I hit this sentence and realized
  > The detail that turned a suspicious directory into a story: the encryption key.
mococa · 1789731380 · focus · HN ↗
That’s explains the 300 million of tokens on the weekend only if you use their tool.
1. nullbio · 1789749411 · focus · HN ↗
  It explains why they were letting people use their model for free too.
dude250711 · 1789731429 · focus · HN ↗
Is this a step forward compared to previous distillations or a step backwards?
theplumber · 1789731457 · focus · HN ↗
Ohhh no another one found that agents don’t actually run locally. We already had the “grok uploads all my stuff to Google cloud bucket” news…
next I can’t wait to see news about “ai company is using my data without my consent” as well.
1. TeMPOraL · 1789733145 · focus · HN ↗
  [dead]
2. ThouYS · 1789737489 · focus · HN ↗
  wait, the thing that streams my code into the cloud, and that I let run basically arbitrary commands on my machine... uploads my code into the cloud?! I didn't sign up for this!
Aldipower · 1789731678 · focus · HN ↗
That the article cannot distinguish between the git history 'git log' and the git repository, which is meant here, tells a lot.
Claude Fable uploads my git history (git log) every day to the Anthropic servers!
1. bbor · 1789735348 · focus · HN ↗
  This is bad-faith AI slop rephrasing the original article, but regardless: the extent of the issue is far, far, far beyond the metadata you're discussing. No one has 300MB of commit messages.
  1. peri-cl · 1789736854 · focus · HN ↗
    > "No one has 300MB of commit messages."
    Maybe Yegge does
  2. progval · 1789745081 · focus · HN ↗
    > No one has 300MB of commit messages.
    Commit messages in <a href="https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git" rel="nofollow">https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/lin... sum to 900MB.
    Also, this commit message alone: <a href="https://gitlab.com/old-game/sb-b/nanobox.io/nanobox-pkgsrc-lite/-/commit/857d286123acf87ae4a08528a3eef4ce2fbf8db2" rel="nofollow">https://gitlab.com/old-game/sb-b/nanobox.io/nanobox-pkgsrc-l... weighs 100.5MB (they squashed years of history as a single commit).
    bbor · 1789748327 · focus · HN ↗
    lol okay you got me. Linux itself might!
2. vikramkr · 1789737365 · focus · HN ↗
  It's funny because the author of the article is obviously Claude but most Claude models would definitely know the difference. Some sort of free tier model being used to summarize some other blog that's also ai translated originally it seems.
3. TuxSH · 1789740343 · focus · HN ↗
  Does it do so while using an asymmetric key encryption key?
  1. eli · 1789744173 · focus · HN ↗
    Kind of? It uses SSL
orf · 1789732122 · focus · HN ↗
Ironic, given the various people here[1] extolling their trustworthiness because they have a “don’t train on my data” option.
1. <a href="https://news.ycombinator.com/item?id=49737922">https://news.ycombinator.com/item?id=49737922
api · 1789732171 · focus · HN ↗
Lots of modern software plays it loose with privacy, but this IMO crossing a second line: doing so with zero notification whatsoever, in a massively intrusive way, against data that is almost certainly private and possibly illegal to exfiltrate, with no obvious way to turn it off.
That crosses into outright malware.
Makes me not want to use GLM or other Z.ai models either, since who knows what interesting easter eggs are embedded in their training data.
1. menaerus · 1789733962 · focus · HN ↗
  How do you know this is not true with other vendors? I'm not defending them but I wouldn't believe anyone in this business unconditionally. Anthropic agent fwiw is not open source, gemini and codex are.
  1. nullbio · 1789749671 · focus · HN ↗
    People have found many nasties embedded in Claude Code over the last couple of years. You can't trust a closed source harness. You can barely trust an open source one.
2. peri-cl · 1789737021 · focus · HN ↗
  > "against data that is almost certainly private and possibly illegal to exfiltrate"
  I didn't fully understand the article, but I gathered this only impacts project directories managed by Z.ai's coding agent? I.e., things you're already choosing to upload to them (partially), which thus cannot be private.
  I'm not defending this malware; just trying to find clarity about its scope.
3. bigyabai · 1789787576 · focus · HN ↗
  > my Bayesian priors were just updated in its direction very slightly.
  If arbitrary data retention is how a company qualifies itself as Russian, then FAANG is lit up like the Kremlin.
4. cyberamirul · 1789800217 · focus · HN ↗
  [dead]
loh · 1789732201 · focus · HN ↗
I recently began playing around with ZCode. Works pretty well. Super sketchy though if it is in fact silently uploading full git history of every user's projects. This is why we need not only open weight models, but open source harnesses as well. Luckily the project I'm trying ZCode on is already open source (Molecule.dev), and I'm already allowing full telemetry with my other agents/harnesses (e.g., Claude) for this particular project, so it's not a huge deal in my case, but it's obviously a huge deal for anything proprietary.
novaapi · 1789732316 · focus · HN ↗
[dead]
andy_ppp · 1789732504 · focus · HN ↗
Quite a clever idea - the LLMs can probably learn a lot from how software develops over time. Claude and Codex are likely to try things like this, more data is like a drug addiction for these companies!
aidiveyt · 1789732959 · focus · HN ↗
[dead]
philbo · 1789734833 · focus · HN ↗
Tangential, mildly amusing thing I noticed in my own harness: GLM and particularly Deepseek are both fond of trying to read dotfiles and anything listed in your .gitignore files. I only noticed it because I have separate read scopes for project files, ignored files, dotfiles and external files, so the latter three always prompt me for approval.
I'm sure there's a perfectly reasonable explanation for it, which has nothing at all to do with exfiltration of secrets, but it does amuse me when it happens. I imagine the labs have access to lots of secrets that various actors would like to get their hands on...
(shameless plug for my own harness: <a href="https://www.opairdev.org/" rel="nofollow">https://www.opairdev.org/ )
v3ss0n · 1789735303 · focus · HN ↗
Never use a Harness if it is not opensourced.
DeepSeek Harness is my favorite for coding. Hermes is my favourite for Other things , followed by OpenCode (sucks at managing long running services) .
Others swear by Pi.dev
1. drdexebtjl · 1789736713 · focus · HN ↗
  Z.ai are temporarily offering unlimited usage during off-peak hours with their harness, which is a pretty good deal if your project is public even with this news.
  1. oathvz · 1789737328 · focus · HN ↗
    All fun and game until it also silently uploads your other things.
    DaSHacka · 1789738068 · focus · HN ↗
    You could always sandbox it or run it in a container
    lenerdenator · 1789738710 · focus · HN ↗
    Shouldn't do that, either.
    Mind and marketshare are currency in this space. Either these people are honest and deserve your trust and business, or they don't. They've been mischaracterizing the way they've been handling your data. Shut them off accordingly until they make things right.
    DaSHacka · 1789744406 · focus · HN ↗
    I mean, it's just basic access control. You don't need to trust every program you run with 100% of all your personal/private information, just confine it to a specific domain accordingly.
    I'm fine with certain codebases and configs being shared, but not others, hence the sandbox/container recommendation. I suspect many others are the same way.
    lenerdenator · 1789744800 · focus · HN ↗
    It's less about access control and more about corporate behavior control. When you ask a contractor to come fix something about your home, you don't have to clarify to them that they shouldn't also be snooping around the bedroom drawers and taking pictures to be stored somewhere.
    You shouldn't have to go and create zero-trust environments for things to operate in because tech companies can't be trusted to be honest and transparent about how they handle your data. It should be a given that they're up-front about what they do with it within the various terms and licenses, and easy to enforce those terms.
    Those that cannot behave in such a way should get exactly zero of your business, even if the product is free and you can set up ways to block any sort of intrusions.
    voakbasda · 1789826374 · focus · HN ↗
    I could not agree more. The rise of sandboxing reflects a decrease in trust. Not just in AI. You just don’t download stuff from the internet anymore. It does not matter who created it, or whether it is open source. There is too great a possibility that the package has been blessed with either incompetence or malice by its creators or contributors.
    I hope nobody thinks that software produced by these obviously immoral sociopathic corporations should be exempt from such suspicion, when history shows time and time again with news stories like this that they do not deserve such trust.
    codedokode · 1789748145 · focus · HN ↗
    You should use a sandbox. It is dumb to run any proprietary software without a sandbox, especially LLM-powered.
    skeptic_ai · 1789798345 · focus · HN ↗
    Create a few terra repo
2. tontinton · 1789738956 · focus · HN ↗
  Or <a href="https://maki.sh" rel="nofollow">https://maki.sh :)
  1. v3ss0n · 1789743863 · focus · HN ↗
    looks cool would be nice if its GUI , terminal have limitations .
    aftbit · 1789745933 · focus · HN ↗
    Funnily enough, I feel the exact opposite! The limitations of terminal make them portable while still being more than powerful enough. But then I've used vim as my editor for going on 15 years now so I'm biased.
    v3ss0n · 1789891874 · focus · HN ↗
    I do used vim for many years too , but when developing web apps , Terminal become a limitation , things cannot be preview outright in the interface is a big downer.
    Huge plus for GUI base dapplicaitons : you can view total and complete render of HTML , PNG , SVG , PDF right in the IDE/Harness tools. That is no where terminal app can do with good performance .
3. wyrdcurt · 1789748742 · focus · HN ↗
  ZCode is pretty bloated anyway, in my experience. I used it for a while because Z.ai offers a subscription usage multiplier for using it, but despite that, I found myself hitting limits less often when I switched to Pi (and performance is the same, if not better).
alightsoul · 1789735359 · focus · HN ↗
This sounds a lot like the same thing Openai did with navier stokes, but Openai is more stealthy about it.
hn1rig3rak · 1789735591 · focus · HN ↗
Built a similar read-scope gate and the fiddly bit was symlinks escaping the project root.
tonyhart7 · 1789736025 · focus · HN ↗
chinnese doing chinnese thing
weiran · 1789737598 · focus · HN ↗
I've been using ZCode since it's initial release and can't find any of this in my data. There aren't any logs showing capture or upload, and I don't even have a ~/.zcode/v2/checkpoints/ directory.
So unless they've cleared it all with a recent update then it doesn't seem to affect everyone.
1. nullbio · 1789749330 · focus · HN ↗
  Is there actually any proof of this, beside this Claude written website and a random x post from some unknown person? Would be nice to have confirmation from someone with a reputation. It's probably true, but you never know...
  1. weiran · 1789810219 · focus · HN ↗
    Not that I've seen. The only follow up I've seen from someone was it only happened if you had a free account and not paid (which would explain why I'm unaffected)
  2. yuuna · 1789974533 · focus · HN ↗
    <a href="https://cdn-zcode.z.ai/zcode/electron/releases/3.12.3/windows-x64/ZCode-3.12.3-win-x64.exe" rel="nofollow">https://cdn-zcode.z.ai/zcode/electron/releases/3.12.3/window...
    in the asar, search for string that contains "/api/v1/snapshot/upload-credential", that's the endpoint signing the S3 upload url, triggered every prompt
rfgplk · 1789738226 · focus · HN ↗
This is all publicly available anyways, who cares? Also you're practically consenting to it when you run an agent locally
itsmeduncan · 1789738543 · focus · HN ↗
[dead]
crossroadsguy · 1789739098 · focus · HN ↗
At this point does any of us/you really think all those piss-cheap tokens are coming out of thin air? That unlimited token-usage during certain hours was not coming from Chinese side of Himalayan glaciers, was it?
Besides why would you use a closed source harness from a certain place, even if you decide to use the model (if nothing then for the price alone). And, that first remark wasn't just for ZAI but all the providers.
At this point: wrapping the harness around something like sandbox-exec or agent-safehouse is a must. Better still, create a new user account (after so much resistance I am warming up to the idea).
Will ZAI see a blowback after this news? Naah. People will keep using it. Hell, I will keep using it. That's how it is now - post truth and post LLM world.
PS. Anyone singing praise of OpenCode here, it's literally one of the worst harneses, open or not. Just look at their fricking issues - the strategic and rampant placements of "no planned" is mind boggling. And for what? Slightly better than ClaudeCode in token consumption and that too starts getting muddled after a while.
1. nullbio · 1789749568 · focus · HN ↗
  OpenCode performs the worse on benchmarks out of all harnesses too.
shevy-java · 1789739185 · focus · HN ↗
Well - spy agents. Not surprising. But people could have suspected this before surrendering to AI skynet.
pmarreck · 1789740927 · focus · HN ↗
I'm having difficulty trusting anything Chinese at this point and I'm trying very hard not to lapse into stereotyping
4b11b4 · 1789741652 · focus · HN ↗
WTF is token stead this is pure content marketing slop? Genuine question
rvz · 1789742026 · focus · HN ↗
Again. You really should stop using closed source harnesses, just because "It's cheap!".
jedisct1 · 1789742218 · focus · HN ↗
You know, swival.dev is fully opensource, doesn't hide anything, fully supports GLM, has excellent context management to keep token usage low, and doesn't send anything you didn't ask to the cloud.
Palmik · 1789745697 · focus · HN ↗
Seems like a repeat of the Grok CLI fiasco:
<a href="https://news.ycombinator.com/item?id=48892468">https://news.ycombinator.com/item?id=48892468
<a href="https://x.com/a_green_being/status/2076598897779020159" rel="nofollow">https://x.com/a_green_being/status/2076598897779020159
nullbio · 1789749204 · focus · HN ↗
Evidently there's not a single inference provider that can be trusted. This is why I don't use OpenRouter either. How am I supposed to trust all of those random providers I've never heard of, when I can't even trust the ones I have heard of? Day by day, the entire industry is hellbent on proving that open-weights and self-hosting is the only safe path forward for us all.
codedokode · 1789752510 · focus · HN ↗
Is it much different from Apple and Google who trick user into agreeing and upload all user's data into a US cloud for convenient LE access?
Also, as I understood, this is a feature to allow server-side indexing of the project. But of course I wouldn't run this, and I generally wouldn't run an IDE or AI tools without a sandbox. They use third-party libraries and plugins from random people on Github and how many telemetry, auto-updates (read backdoors) are there. You must be crazy to run an IDE, its plugins, package managers and build scripts without a sandbox.
shunhe · 1789756167 · focus · HN ↗
[dead]
1. dang · 1789759045 · focus · HN ↗
  Can you please not post AI-generated or AI-edited comments to HN? It's not allowed here - see <a href="https://news.ycombinator.com/newsguidelines.html#generated">https://news.ycombinator.com/newsguidelines.html#generated and <a href="https://news.ycombinator.com/item?id=47340079">https://news.ycombinator.com/item?id=47340079.
  Of course, it's impossible to know for sure what was LLM processed or not, but some of your posts (like this one) have been getting classified that way.
  1. shunhe · 1789839615 · focus · HN ↗
    Sorry I had it edit a comment here or there but will avoid now
[deleted] · 1789778032 · focus · HN ↗
[deleted]
ff114514 · 1789790547 · focus · HN ↗
You people are making too much of a fuss; even we don't use our own products.
[deleted] · 1789851203 · focus · HN ↗
[deleted]

Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.