Let’s talk about the AI coding tool that packaged an entire private repository — every commit, every deleted password, every line of work somebody spent four years building — encrypted it with a key only its maker could open, and tried to send it to the cloud five hundred and sixty-four times.
It got caught because a man ran out of disk space.
There’s a developer who publishes as ferstar. He pays for the GLM Coding Max plan — the paid coding subscription from Z.ai, the Beijing company behind the GLM models. He’s not an auditor. He’s not a researcher. He liked the tool enough that on the evening of the 17th of September he was pitching it to friends in a developer group chat.
Then his MacBook Air, the 256 gig one, permanently starved for space, told him it was full.
So he went digging, and found a folder called .zcode sitting on more than seven hundred megabytes he didn’t remember creating. Inside it, in a checkpoints directory, a 313 megabyte encrypted file, next to a small plaintext note. That note is where the whole thing opens up. It named the workspace path — a live commercial project of his — the compressed size, the original size, a snapshot kind called “baseline,” and then one more line. failureCount: 564.
Five hundred and sixty-four failed attempts to upload his entire repository.
He didn’t guess the rest. He unpacked the app and read it.
While he was logged in, the client packed his workspace into an archive. Forty-two thousand four hundred and eleven files, 345 megabytes, with node_modules and a few other folders excluded. What was left was almost pure intellectual property. It encrypted that archive, wrapped the key using a public key the server handed it on the fly, and posted the encrypted file directly to Alibaba Cloud object storage. Not through Z.ai’s own servers. Straight to the bucket.
And the key that unwraps it? That lives in Z.ai’s cloud. Not on his machine. He tried every private key he had. The client itself can’t open that file either. Neither can you.
Think about what that means for a second. If this were built for your benefit — crash recovery, device sync, rollback — the key would be yours, the way it is with Git, or Time Machine, or any backup you actually own. A key only the server can use serves exactly one purpose: making sure the server can read everything.
Now here’s the part that matters more than the size.
Of that 313 megabytes, the .git directory was 86.6 percent. Objects — the complete commit history — 102 megabytes. The LFS cache, every large binary asset ever pulled through that repo, 196 megabytes. Reflogs, including branches that were never pushed, small but there. And the actual source code and docs? About 46 megabytes. Thirteen percent.
Which means the thing that tried to leave was mostly not your current work. It was the record behind it. The old config with the API key you deleted a year ago and never rotated. The credential, the client detail, the pricing logic, the abandoned branch, the commit message where you wrote out what you were actually planning. Your working files are the presentable version. The history is the interrogation.
One smaller workspace of his did go through: a public repository, 538 files, about 15 kilobytes after compression, accepted by the server. So the honest scoreboard is this — the big one never left his network, and a small one did leave somebody’s.
Two days later, on the 18th at 17:44, Z.ai put out a statement. It said the behaviour came from “codebase indexing,” that generating Wiki pages in the cloud “may” trigger an upload of repository data, that the data is destroyed immediately after the Wiki is generated, that the feature was on by default during the early launch period, that it has been fixed — and that ZCode would be open-sourced with third-party review. Everyone got an extra weekly quota reset.
Let me put the parts of that next to each other, because they don’t fit.
The privacy policy, archived on the 18th, was last updated on 15 June 2026 and says nothing about full-workspace snapshots or cloud sync. The agent’s own tool list — 31 tools — contains no snapshot tool, no upload tool, no telemetry tool. This pipeline lived at the host level, outside the agent’s tool loop, so every permission prompt you’d normally see never had a chance to fire. And when ferstar turned off both “Optimize Experience” and “Repo Snapshot Indexing,” the client still packed the workspace and still tried to post it. Deleting the pending archive triggered a fresh 313 megabyte repack within half an hour.
That’s not a bug you switch off. That’s a resident pipeline.
On the 21st of September at 09:23, ZCode posted again and dropped a repository on GitHub — Apache 2.0 — and this is where the story stops being about intent and becomes about evidence.
Two commits. An empty initial commit, and one 6,973-file, million-plus-line dump. Internal history flattened. Pull requests locked. Issues disabled. A 27 kilobyte legal notice armouring every outbound network call, with no mention of whole-repo uploads anywhere in it.
And the code itself answers the company’s excuse. Checkpoints, they said, needed the uploads. The published checkpoint service runs on your local Git binary, scoped to your current workspace, storing JSON metadata on your own disk. Zero cloud dependency. Meanwhile, code indexing in the new build runs locally on bundled ripgrep and bfs — and that’s the quiet confession of the entire week. Local code retrieval never needed to send your repository anywhere. Not once.
They also had it checked. A state research academy and a security firm both reportedly confirmed the storage bucket is now empty and the newer client has removed the pipeline. Fine. Necessary. But here’s the thing about a post-incident audit: it can prove a bucket is empty today. It cannot reconstruct what happened to a snapshot that arrived before the 18th. That door doesn’t reopen, and nobody outside the company ever held the key.
So why does this matter beyond one tool, and beyond one country? Because the reflex is going to be to make it a story about a Chinese AI company, or about a vendor’s bad faith — and both readings let you off the hook. Some of the reaction called ferstar a foreign hacker smearing domestic AI. He was a paying subscriber who found his own commercial code being packed up behind his back, and published the packet captures.
Every coding agent you use can read your repository. That isn’t a defect. That’s the job. The model needs context, and your repo is the context. What varies is not the capability — it’s the posture, and the posture lives on the server, in a policy document, in a one-sentence apology, in whatever the client does next quarter after a silent hot update.
You don’t get to check a vendor’s intent. You only get to check the boundary.
And the boundary is the one ferstar ended up building for himself: he locked the checkpoints folder at the filesystem level — chattr +i on Linux, chflags uchg on macOS — and left it there as a tripwire, because the client can still be updated even after the code was stripped out.
That’s the operator lesson, and it’s blunt.
Treat any agent that can read your working directory as having already read it. Give it a directory, not your machine. Watch egress at the network layer, not the permission dialogue — the permission dialogue only covers what the tool admits it can do, and this pipeline never touched the tool loop. Assume your git history is a liability, because a repository isn’t a folder full of files. It’s a folder full of decisions, and the ones you’d least like read are the ones you thought you’d removed. Rotate anything you ever committed. And if a tool can’t show you what it sends, that’s not a setting you’re missing. That’s the design.
The principle underneath all of this is small and it doesn’t move.
Consent isn’t the checkbox. Consent is being able to see what was taken, and being able to verify that it stopped. The apology arrived in a day, the fix in three, the open source in five. Every one of those is a statement about the future. Not one of them is evidence about the past.
You can audit the client. You can’t audit the bucket.
So ask what your tools are able to send. Then go and check. That’s not paranoia — that’s just what ownership is supposed to feel like.