ZCode, Z.ai's GLM coding agent, ships your whole .git directory to the vendor before every prompt
A teardown published 18 September reconstructed ZCode's upload flow from its app.asar and found the agent packs the entire workspace, encrypts it, and POSTs it to Aliyun OSS with a callback to the Z.ai backend. The .git directory is 86.6% of the payload, with .git/lfs at 56.8% and .git/objects at 29.6%, meaning full repository history including deleted API keys, unpushed branches and internal hostnames from .git/config. Session logs showed 62 capture events in one active session, triggered before every prompt and on task completion; one 42,411-file workspace produced a 313MB archive. The envelope encryption uses an RSA key only Z.ai holds, so the user cannot decrypt their own archive. Single-source and the vendor response so far is one affiliated account saying 'hey I am sorry to let you find it', so treat it as credible but unconfirmed.
Source
↳ Follow the thread