On September 18, 2026, a developer going by ferstar published a reverse-engineering walkthrough of ZCode, the AI coding desktop app from Z.ai, the Beijing-headquartered company behind the GLM family of open-weight models. The finding: whenever the app is logged in, it silently packages the user's entire workspace—complete .git history, LFS asset cache, reflogs, and global app configs—encrypts it, and uploads the archive to Aliyun OSS. One capture: a 313MB encrypted archive from a 345MB commercial workspace (42,411 files), with 564 failed upload attempts logged while investigating.
If you run GLM locally, the company that publishes the weights is not the same thing as the runtime a developer might use on top of them. Several commenters assumed ZCode was open source because GLM is. It is not. The weights are open; the harness is closed.
\nZCode uses envelope encryption: the payload is encrypted with a symmetric key, and that key is wrapped with an RSA-OAEP public key delivered by the server during upload-credential negotiation. The corresponding private key lives only in Z.ai's cloud. ferstar's conclusion: "A key that only the server can use serves exactly one purpose: making sure the server can read your code whenever it wants."
\nIn one 42,411-file snapshot, .git/lfs/ was 196.1 MB (56.8%), .git/objects/ 102.2 MB (29.6%), with source and docs only ~13.4%. The .git directory alone was 86.6% of the payload—years of lineage, not just open files.
The upload pipeline (from app.asar): credentials from zcode.z.ai → pack tar.gz → AES-256-CTR encrypt → form POST to Aliyun OSS → callback to Z.ai.
The capture sidecar starts unconditionally when a valid JWT is available. Session logs showed 62 capture events from a single session. OrcaPromptVault's captured ZCode system prompt shows checkpoint/rewind templates but zero snapshot/upload/telemetry tools—the pipeline is host-level, outside the agent tool loop.
\nZCode's privacy policy discloses conversational "text, files, and code submitted during conversations" but, per ferstar, does not mention packaging and uploading entire workspaces and git histories.
\nDeleting the pending archive does not stop re-packaging. Filesystem-level immutability on ~/.zcode/v2/checkpoints does:
Linux: chattr +i ~/.zcode/v2/checkpoints
macOS: chflags uchg ~/.zcode/v2/checkpoints
Trade-off: checkpoint rollback UI stops; chat and tools continue.
\nA locally-running model wrapped in a cloud-phoning harness is not local. Two checks for every harness: what does the runtime transmit when logged in, and who can decrypt what it stores.
\nSources include ferstar's forensics post and X threads; see the original Tokenstead guide for full diagrams and citations.
","headings":[{"level":1,"text":"ZCode uploads your entire git history, and only Z.ai holds the key","id":"zcode-uploads-your-entire-git-history-and-only-z-ai-holds-the-ke"},{"level":2,"text":"Envelope encryption with a server-only key","id":"envelope-encryption-with-a-server-only-key"},{"level":2,"text":"What gets packed","id":"what-gets-packed"},{"level":2,"text":"The toggles do not stop it","id":"the-toggles-do-not-stop-it"},{"level":2,"text":"Privacy policy gap","id":"privacy-policy-gap"},{"level":2,"text":"Defense that works","id":"defense-that-works"},{"level":2,"text":"What it means for local AI","id":"what-it-means-for-local-ai"}]}}