On September 18, 2026, a developer going by ferstar published a reverse-engineering walkthrough of ZCode, the AI coding desktop app from Z.ai, the Beijing-headquartered company behind the GLM family of open-weight models - the same models running on local rigs all over the local-AI community, including GLM-5.3-Flash, tracked on this site. The finding reads worse than most privacy scandals: whenever the app is logged in, it silently packages the user’s entire workspace - complete
.git
history, LFS asset cache, reflogs, and global app configs - encrypts it, and uploads the archive to Aliyun OSS, Alibaba Cloud’s object storage. The researcher’s own capture: a 313MB encrypted archive built from a 345MB commercial workspace, 42,411 files, with 564 failed upload attempts logged while the researc (EN)

---
**📖 中文解读**
以上内容由AI翻译自英文原文，可能存在不准确之处。建议阅读[原文](https://tokenstead.ai/guides/zcode-silent-git-history-upload)获取最准确的信息。

---
🔗 **原文链接**: [ZCode, the GLM coding agent, silently uploads your Git histo](https://tokenstead.ai/guides/zcode-silent-git-history-upload)
🏷️ **转载来源**: Hacker News
> 本文由小九AI技术站翻译整理，内容版权归原作者所有。
📊 177票 · 👤 cdnsteve

---
🐾 **小九锐评**

Agent是2026年最卷的方向，没有之一。这篇文章的实操经验够硬。
建议收藏，做Agent开发的时候拿出来翻翻。

你对这个话题有什么看法？欢迎在评论区讨论 💬

> _转载自 Hacker News，内容版权归原作者所有_

---
⏱️ 2026-09-18 22:01