ZCode packaged developers' whole .git history for upload, and Z.ai open-sourced the client in response
The rule that allows .git runs ahead of every exclusion in ZCode's filter chain, so neither the 1 MB size cap nor the key filter ever touches what's inside it.
On September 18, 2026, a developer who writes as Vonng took apart Z.ai's ZCode client and published what he found. ZCode is the coding agent Z.ai ships for its GLM models, as a desktop app and in the terminal. He'd been paying for it for a few days, and he liked it.
The client snapshots your workspace when you send a prompt and when a task finishes. It asks zcode.z.ai for upload credentials and an encryption public key, packs the workspace up, encrypts it, then pushes the archive to Alibaba Cloud's object storage. The whole of .git goes with it.
- Client examined
- ZCode 3.12.3 on macOS
- Where the archive went
- Alibaba Cloud OSS, encrypted
- One workspace snapshot
- 8,323 of 9,619 files were .git, 93.9% of the bytes
- Local decryption
- there was no decryption key on the local machine
- Z.ai's answer
- ZCode open-sourced under Apache-2.0
- The repository now
- 2 commits, 6.2k stars, 1.8k forks
Why the filters didn't catch it
File filtering in ZCode is an ordered chain of checks, and the rule that allows .git sits ahead of every exclusion. So neither the 1 MB size cap nor the filter that looks for key files ever reaches anything underneath it. That's how a 137 MB packfile goes whole.
What it leaves behind is the problem. A credential you committed once and deleted the same day is still sitting in .git/objects, and rewriting history with filter-repo doesn't save you either (Vonng found .git/filter-repo and .git/lost-found in one of his own repositories). It goes out intact.
What I object to is taking data without telling me, taking all of it, and giving me no way to turn it off
What he could and couldn't confirm
Four workspaces on his machine had snapshot records under ~/.zcode. One went up and the client recorded it as accepted, though Vonng says that snapshot held PostgreSQL translation files and no .git directory at all. Two others were 93.9% and 98.5% .git by size and had already been handed upload credentials. Whether they finished, he doesn't know.
He stops there, and says so. The workspace he calls pgdoc produced an encrypted output of 1,073,774,608 bytes, which is 32,784 bytes over a gibibyte, and the server supplies that size threshold while the client enforces it. (ZCode's privacy policy, he notes, took effect on June 15 this year.)
An agent desktop client is a persistent background process with permission to read your entire disk and access the network
What Z.ai did about it
On the evening of September 20, 2026, Eastern time, Z.ai posted that it had completed the remediation the community's reports called for, apologized to its users, and open-sourced ZCode to put the code under community scrutiny. Vonng's post had put four questions to the company. The first one asks which feature the snapshot mechanism exists to support.
The code is at github.com/zai-org/ZCode under Apache-2.0, with 6.2k stars and 1.8k forks on it this morning. It also has two commits. The client that packaged up other people's Git history arrived without any of its own.