ZCode ships your Git history to the cloud without asking

What happened

Two separate write-ups landed on Hacker News within a day of each other, both dissecting the same behavior in ZCode, a coding agent built on Zhipu's GLM models. The Tokenstead guide and a longer teardown on blog.ferstar.org each pulled the same thread: when you launch ZCode inside a Git repository, the client silently packages up a snapshot of the workspace — tracked files, uncommitted diffs, and Git metadata — and ships it to a remote endpoint before it ever answers your first question.

The researchers captured this by pointing ZCode at a scratch repo, running a proxy in front of it, and watching multi-megabyte multipart uploads leave the machine within seconds of startup. The payload wasn't a stripped context window or a hashed fingerprint. It was the working tree plus enough Git plumbing to reconstruct history: recent commits, author identities, branch names, and in some captures the contents of `.git/config` — which on a lot of developer machines still contains a plaintext token in the remote URL.

Neither post frames this as a bug. It's the product's default behavior, gated behind nothing more than launching the binary. There's no consent dialog, no `--upload-context` flag, no mention in the onboarding. The Ferstar teardown notes the client doesn't respect `.gitignore` for the snapshot either — files you deliberately kept out of version control get swept up alongside the rest.

Why it matters

Coding agents have a real context problem: the model is only useful if it can see enough of your codebase to reason about it, and the pragmatic answer most vendors have converged on is "send a lot, ask forgiveness later." Cursor, Copilot, Cody, Continue — all of them ship code off-device, and all of them have had at least one round of "wait, you're uploading *what*?" discourse. What makes ZCode notable isn't that it uploads code. It's that it uploads Git history, and does so before the user has typed anything.

That distinction matters for three reasons. First, Git history is where the skeletons live. The password someone committed in 2019 and force-pushed out of `main` is still sitting in the reflog of every clone. Purged secrets, half-finished features, private forks of proprietary code — all of it is one `git log --all` away, and a workspace snapshot that includes `.git/` grabs the lot. Second, the upload happens pre-prompt. There's no "the user asked me to refactor this file, so I need to see the file" justification — the data leaves whether you use the tool or not. Third, the destination is a Chinese-hosted endpoint tied to Zhipu's infrastructure, which for a meaningful slice of the developer audience is a compliance conversation that ends the pilot on the spot.

Community reaction on the HN threads (217 and 278 points respectively, unusually high for a single-vendor security post) split predictably. One camp: "this is how all these tools work, you're naïve if you thought otherwise." The other camp, and the one that reads the traffic dumps more carefully, points out that most competitors at least scope uploads to files the model needs to answer the current query — ZCode's snapshot is indiscriminate and up-front. The Ferstar author put it plainly: "it's not that it phones home. It's that it phones home with your entire filing cabinet before you say hello."

There's also a supply-chain wrinkle that neither post fully develops but both hint at. The uploaded snapshot includes remote URLs. If a developer has SSH keys or personal access tokens embedded in those URLs — still depressingly common in dotfiles and CI configs — those credentials now sit on a third-party server with unknown retention. Rotating them is straightforward. Knowing you need to rotate them requires reading a Hacker News post.

What this means for your stack

If ZCode has touched a work machine, treat it as an incident, not a curiosity. Concretely: rotate any credentials that have ever been committed to any repo you opened in the tool, audit `.git/config` for embedded tokens, and pull egress logs for the install window to see what actually left. The Tokenstead guide includes the specific endpoints to grep for. If you're on a corporate network with any kind of DLP, the traffic should be visible; if you're not, this is a good week to reconsider that.

The broader move is to stop trusting coding-agent vendors' defaults and start treating the network layer as the source of truth. Run new agents behind a logging proxy for the first hour. Watch what leaves. This is fifteen minutes of setup with `mitmproxy` and it catches this exact class of problem — silent context exfiltration, telemetry that includes file contents, third-party analytics SDKs bundled into the binary. The alternative is trusting a privacy policy written by the same company that decided uploading your Git history was a reasonable default.

For teams evaluating agent tools, add two questions to the eval rubric: (1) what leaves the machine before I send a prompt, and (2) does the upload scope respect `.gitignore` and exclude `.git/`. Both are answerable in an afternoon of packet capture. Neither is answerable from a marketing page.

Looking ahead

ZCode will almost certainly ship a patch — the pattern with this kind of disclosure is a quiet config flag within a week, a blog post about "enhanced privacy controls" within a month, and no acknowledgment that the default was ever wrong. The more interesting question is whether any of the larger coding-agent vendors get audited to the same depth, because the honest answer is that most of them haven't been, and the ones that have came out looking better than ZCode but not by as much as their users assume. The next six months of this category are going to be defined less by benchmark scores and more by whose traffic dumps survive contact with a curious researcher.