Inside ZCode: Silently uploading your Git history to the cloud
blog.ferstar.org296 points by csmantle a day ago
296 points by csmantle a day ago
z.ai made a statement, screenshotted in this article: https://finance.sina.com.cn/tech/roll/2026-09-18/doc-inisfye...
claude translation:
Dear ZCode users,
We take today's community discussion very seriously. We carried out an internal review right away, and we first want to apologize to the affected users. Here is an explanation of what happened:
The issue stems from ZCode's "codebase indexing" feature. This feature is meant to help users generate a repository index locally, which supports session checkpoint restoration (including past versions), rolling back to past versions, and Repo Wiki, among other things.
When the Repo Wiki feature generates Wiki pages, it may trigger an upload of repository data. After the Wiki pages are generated in the cloud, the uploaded data is destroyed immediately and is not stored. Because this feature was enabled by default in its early launch period, some users were affected. We sincerely apologize for this. The issue has now been fixed.
We understand that any data-related issue directly affects users' trust in a product. We will open-source the ZCode codebase in the near future so we can improve the product within a more open ecosystem. We will also invite third-party evaluators to review how the system operates, and we'll keep publishing updates on the review, building your trust with full transparency.
We deeply apologize for the trouble this has caused. As compensation, all ZCode users will receive one extra weekly quota reset, which will be issued today.
Thank you again for your attention and oversight.
Huh - anyone recall other examples of open sourcing a product code base to mitigate a user trust issue? (In 2026 it's perhaps less powerful because "you're just going to feed it to some AI tool anyway" but I think it's an interesting attempt to make and I don't think I've seen it before...)
> it's an interesting attempt
I didn’t take it in a very positive way, myself. I don’t know if I got my money’s worth before I have seen the deliverable.
At least the quota reset is immediately visible, so I took that part seriously.
I feel like it has happened, but I certainly can't remember a specific time. It feels in a similar vein to the NSA releasing Ghidra to the public as open source software after the Snowden leaks.
I mean, on the contrary, imagine if the NSA released Ghidra as closed source software. In a sense they really did have to open source it to mitigate a serious user trust issue.
It just happened 2 months ago when xAI open-sourced Grok Build following a similar controversy (wholesale uploading of user repositories). Though ZCode's case here is way worse since there is literally no way to opt-out and the client will always ask the backend for credentials to upload.
Is it naive to assume that the agent will try and access anything on your disk, either accidentally or maliciously?
Permissions classifiers in auto mode are just models trying to guess if they're doing the right thing.
Claude Code will tell you that it went around a sandbox because the sandbox blocked it. At which point, you ask yourself the point of the sandbox.
You need to treat agents as an independent user you're allowing on your machine.
Give them their own account. Give them only the access you want them to have. If they "hack" around that, do what you'd do to any other malicious user: kick them off.
It's not naive it makes running these ai agents inside the sandbox even more important
It's not a sandbox if you can just snap your fingers and wish your way out of it.
Not naive at all, which is why there are so many AI sandboxes: https://pleasedonotescape.com/
While we're on this, I find it really really weird how windows defender insists on sending my codex work files for analysis all the time (which I block in automatic permissions so it has to ask me in a notification). I don't think i've seen it ask to upload more than one or two things, and it doesn't do it with other AI app I use (eg Claude Code) but they really want to see what's inside my codex files.
It's easy to trigger, I just need to go inside Codex settings and change something, it saves and instantly windows defender who never wants anything want to "you may be at risk, let me upload that for analysis yes/no".
Is it much different from Apple and Google who trick user into agreeing and upload all user's data into a US cloud for convenient LE access?
Also, as I understood, this is a feature to allow server-side indexing of the project. But of course I wouldn't run this, and I generally wouldn't run any IDE or AI tools without a sandbox.
Sadly this plague of silent auto-updates is spreading to Linux. For example, browser plugins in Firefox on Linux can silently auto-update without user consent and without any checks and can be used as backdoors. Furthermore, the auto-updates are not using a package manager; firmware also seem to quietly update and also is not using a package manager.
They learned nothing from the Grok Code saga.
If anything, that should have been a learning lesson to NOT trust harnesses, especially new ones.
Probably anything concerning that one just register as satirical fictions at this moment to many
Tangential, mildly amusing thing I noticed while implementing my own harness: GLM and particularly Deepseek are both fond of trying to read dotfiles and anything listed in your .gitignore files. I only noticed it because I have separate read scopes for project files, ignored files, dotfiles and external files, so the latter three always prompt me for approval.
I'm sure there's a perfectly reasonable explanation for it, which has nothing at all to do with exfiltration of secrets, but it does amuse me when it happens. I imagine the labs have access to lots of secrets that various actors would like to get their hands on...
(shameless plug for my own harness, which is open source and doesn't have a backend to send any data to: https://www.opairdev.org/ )
Secrets should not be inside a versioned directory nor usually readable by the process that uses them in production. They should be only in the environment (e.g. by root only readable init config).
In development you should not be using the real production values.
i use sops
Encrypt: sops encrypt --input-type dotenv --output-type dotenv .env > secrets.enc.env
then rm .env
You can then run your script/dev with: sops exec-env secrets.enc.env 'docker xxxx' (it will ask you for your password, or touch-id to decrypt the secrets)
I like this because this way the .env doesn't sit in the directory at all, and is only passed to your dev environment and stays in it while it's running
Decrypt back to a file (if you ever want that): sops decrypt secrets.enc.env > .env
---
Well ofc, any agent can do docker inspect to get all those env vars, but atleast reading the dotfiles won't do anything
you can also edit the file with: sops --input-type dotenv --output-type dotenv secrets.enc.env
It is no longer surprising to me that my cursor acts as if it does not recognize the .env file, and while I am editing it, it does not give inline suggestions;
however...when it is debugging problems or responding to questions about the code, it will just say it read my env file and found xxx environment variables as a verification step, or sometimes it will even mention that I need to uncomment some environment variables in the env file, which makes the whole deal about security feel iffy giffy....
They act exactly like how I would act if I were dropped into someone's machine and tasked with accomplishing a goal "at all costs". Hunting around for context to understand what I'm dealing with and to an extent profiling the previous user for their workflows and competency.
I tested GLM while working on some android app, the agent had adb access to the device. It suddenly went to the Gallery and started scrolling around, taking screenshots, lol. A friend had a similar experience with GLM where it would for no very clear reason start snooping through the filesystem.
Haven't used it after that.
Just my thoughts on the site:
It's good that the objective is to have the model work as a helper, but that's what everyone can already do with CC or Codex as long as you don't ask to "write this entire x thing". It's also what a billion other, often vibecoded, harnesses claim they can do.
Why should I use yours, which also forces me off my existing subscriptions? Maybe it's (mostly) handwritten, so it's mindful efficient code instead of slop, and each adjustment was made through trial and error with current models? maybe it IS slop but at least you have a unique feature? and so on and so forth.
There had to be a catch to the "free" promotion they're offering this month if you use ZCode. Glad my instinct to isolate it helped me, but I feel sorry for anyone whose secrets, etc. got vacuumed up by Ziphu
Things like that - and other examples posted here - are why I 'm sticking with OpenCode despite it having some papercuts that annoy me.
The incentives are not there for them to do shady stuff like vacuum your files, inflate your token count just because or many other things.
Open code is great and I use it, however, they were caught uploading prompts to their summarization AI instead of using the configured AI model endpoint. This has since been fixed.
That said, running in a completely offline mode remains unnecessary difficult to configure. In particular, toggling off Zen seems to require a community plugin.
Never use a Harness if it is not opensourced.
DeepSeek Harness is my favorite for coding. Hermes is my favourite for Other things , followed by OpenCode (sucks at managing long running services) .
Others swear by Pi.dev
Or https://maki.sh :)
looks cool would be nice if its GUI , terminal have limitations .
Funnily enough, I feel the exact opposite! The limitations of terminal make them portable while still being more than powerful enough. But then I've used vim as my editor for going on 15 years now so I'm biased.
ZCode is pretty bloated anyway, in my experience. I used it for a while because Z.ai offers a subscription usage multiplier for using it, but despite that, I found myself hitting limits less often when I switched to Pi (and performance is the same, if not better).
Z.ai are temporarily offering unlimited usage during off-peak hours with their harness, which is a pretty good deal if your project is public even with this news.
All fun and game until it also silently uploads your other things.
You could always sandbox it or run it in a container
You should use a sandbox. It is dumb to run any proprietary software without a sandbox, especially LLM-powered.
Shouldn't do that, either.
Mind and marketshare are currency in this space. Either these people are honest and deserve your trust and business, or they don't. They've been mischaracterizing the way they've been handling your data. Shut them off accordingly until they make things right.
I mean, it's just basic access control. You don't need to trust every program you run with 100% of all your personal/private information, just confine it to a specific domain accordingly.
I'm fine with certain codebases and configs being shared, but not others, hence the sandbox/container recommendation. I suspect many others are the same way.
It's less about access control and more about corporate behavior control. When you ask a contractor to come fix something about your home, you don't have to clarify to them that they shouldn't also be snooping around the bedroom drawers and taking pictures to be stored somewhere.
You shouldn't have to go and create zero-trust environments for things to operate in because tech companies can't be trusted to be honest and transparent about how they handle your data. It should be a given that they're up-front about what they do with it within the various terms and licenses, and easy to enforce those terms.
Those that cannot behave in such a way should get exactly zero of your business, even if the product is free and you can set up ways to block any sort of intrusions.
That’s explains the 300 million of tokens on the weekend only if you use their tool.
Evidently there's not a single inference provider that can be trusted. This is why I don't use OpenRouter either. How am I supposed to trust all of those random providers I've never heard of, when I can't even trust the ones I have heard of? Day by day, the entire industry is hellbent on proving that open-weights and self-hosting is the only safe path forward for us all.
Closed source agents are a red flag no matter if its China or America. Always use an open harness with a good reputation and enough users that someone will notice if they push malicious code like this one here. Right now that's Opencode and Pi.
I wouldn't list Opencode as "good reputation".
They had their own unbound "harness scans the whole user directory" oopsie and handled concerns about that by introducing code signing.
Which, yes, does have absolutely nothing to do with that issue.
I guess by now it is better, but to me they seem to lack the engineering culture necessary for a "good reputation" stamp.
__
Ref: https://github.com/anomalyco/opencode/issues/14925#issuecomm...
among other issues.
How about the one where if you start a session outside of a Git repository, the "worktree root" is set to /. Bug report closed as "not planned".
FWIW, I don't think that they're being malicious. They instead just seem to have no idea nor do they care.
And the original comment I've replied to proves this strategy right! So from a business standpoint: excellent work.
Glad my arbitrary failure to try them has worked out! For people seeking OS-native harnesses, I can recommend Factory's Droid. I know I'll be returning to it with my head hung low today, after I uninstall ZCode.
It does have a "mission" feature that's stuck in the strange, distant times of 2025 by way overdoing mandatory verification steps, which means they don't support swarms/workflows/crews/fleets yet -- that is, it's all done in sequence. But they have the boring, corporate engineering attitude that I think we're are all craving rn, and generally seem competent.
I can heartily dis-recommend Vix, even though they gamed themselves to the top of at least one ranking site that shall not be named; exactly like the quasi-bad-faith incompetence described with OpenCode above, but without even the "Open-" branding! Though perhaps that word has been so thoroughly burnt as a prefix by Sam Altman & Microsoft's criminal behavior that we should let it go...
Is this how "FLOSS" wins over "OSS"? Not with an ideological bang, but with a marketing issue?
> Is this how "FLOSS" wins over "OSS"? Not with an ideological bang, but with a marketing issue?
Nah, I don't think so. Also, we arguably do not want FLOSS to "win" over OSS, because that just means people with no taste or sense cluttering up the repos, issues and support chats.
"Open" being used as a signal for non-hacker people was a weird and unpleasant development, but, if you think about it, it might be a blessing in disguise and shall keep them away from the more pleasant spaces.
It's not that they'd care about being scammed, mistreated and rug-pulled anyway. They want that. They do it themselves all the time. Every time they encounter a space that treats them well, they terraform it into baseline miserable-ness.
So let them have the "Open" prefix. It's just words, anyway.
This is kinda beside the point and this whole thread may be wiped when dang wakes up and notices the AI slop article we're commending under, but your reply is thought provoking so I'll attempt a response anyway;
I'm sure you're far more experienced than I with basically every aspect of this discussion, but I'd argue that's given you a blindspot, here. I'll hit some specifics below, but the headline is that you're effectively taking a stand against Eternal September II -- a goal that I hope we can all agree would be quixotically antisocial, given what followed the first one!
we arguably do not want FLOSS to "win" over OSS
Didn't you get into this stuff to change the world? To liberate the oppressed, undereducated, and forgotten with the radical power of the information superhighway? Cause it reads here like you're more motivated by selfishness (not wanting to bother talking to people with less expertise than you) and resentment. On that note...
They want that. They do it themselves all the time.
Less confrontationally; my mom is in her late 60s, and is pretty computer-literate for her age after decades of knowledge work. Surely you'd agree that she's not, like, evil for using OSX, iOS, GMail, Word, etc.? That she didn't chose those things because of a philosophical commitment to defending IP laws, but rather because of structural reasons? Even if she were pro-IP, wouldn't we want to win good, well-meaning people to our side?
So let them have the "Open" prefix. It's just words, anyway.
I hope none of the above was rude; I'm trying hard to keep my passion for this topic from pushing me past HN guidelines :)
Cutting things short:
> but I'd argue that's given you a blindspot, here
I'd argue it's the opposite. The idealism there _is_ the blindspot. Not the other way round.
You can't save everyone. And you will die trying.
That's the first thing that gets (or should get) hammered into people's heads when they pick up a career in all things social.
Which isn't to say that we shouldn't dream, but I believe that our dreams should be optimized for maximum gain with minimum pain.
Well I personally think we can find a middle ground between single-handedly saving "everyone" from poverty and addiction and oppression as social workers, and not letting anyone into our exclusive philosophy-of-property clubhouse. I would invite you to join us on this pro-social mission, but you seem perfectly content as-is!
Some people are still on Usenet after all (?), so I suppose it's not a big deal if a few people want to cling to old communities. I hope you don't mind if we use the word for what it was coined for though in the meantime, back in the real world.