So strange that this is still up 5 hours later… dang, I am yet again begging you to stop trying to roll your own forum ethos. It’s okay. You’re safe now. We can modernize without losing the magic. I know I know, shh, it’s okay, don’t worry, just flip the markdown and automod switches I know you have…
wait, the thing that streams my code into the cloud, and that I let run basically arbitrary commands on my machine... uploads my code into the cloud?! I didn't sign up for this!
This is bad-faith AI slop rephrasing the original article, but regardless: the extent of the issue is far, far, far beyond the metadata you're discussing. No one has 300MB of commit messages.
It's funny because the author of the article is obviously Claude but most Claude models would definitely know the difference. Some sort of free tier model being used to summarize some other blog that's also ai translated originally it seems.
Closed source agents are a red flag no matter if its China or America. Always use an open harness with a good reputation and enough users that someone will notice if they push malicious code like this one here. Right now that's Opencode and Pi.
Lots of modern software plays it loose with privacy, but this IMO crossing a second line: doing so with zero notification whatsoever, in a massively intrusive way, against data that is almost certainly private and possibly illegal to exfiltrate, with no obvious way to turn it off.
That crosses into outright malware.
Makes me not want to use GLM or other Z.ai models either, since who knows what interesting easter eggs are embedded in their training data.
You know... (puts on foil hat)... I did notice that Z is also the weird Russian logo for their invasion of Ukraine and Russia and China have cooperated to some degree (or at least China is helping Russia in exchange for access to resources). I dismissed this when I first thought of it, but I will now leave it here. Still probably coincidence but my Bayesian priors were just updated in its direction very slightly.
How do you know this is not true with other vendors? I'm not defending them but I wouldn't believe anyone in this business unconditionally. Anthropic agent fwiw is not open source, gemini and codex are.
People have found many nasties embedded in Claude Code over the last couple of years. You can't trust a closed source harness. You can barely trust an open source one.
> "against data that is almost certainly private and possibly illegal to exfiltrate"
I didn't fully understand the article, but I gathered this only impacts project directories managed by Z.ai's coding agent? I.e., projects you're already choosing to upload to them (partially), which thus cannot be private.
I'm not excusing this malware; just trying to find clarity about its scope.
I recently began playing around with ZCode. Works pretty well. Super sketchy though if it is in fact silently uploading full git history of every user's projects. This is why we need not only open weight models, but open source harnesses as well. Luckily the project I'm trying ZCode on is already open source (Molecule.dev), and I'm already allowing full telemetry with my other agents/harnesses (e.g., Claude) for this particular project, so it's not a huge deal in my case, but it's obviously a huge deal for anything proprietary.
Quite a clever idea - the LLMs can probably learn a lot from how software develops over time. Claude and Codex are likely to try things like this, more data is like a drug addiction for these companies!
Tangential, mildly amusing thing I noticed while implementing my own harness: GLM and particularly Deepseek are both fond of trying to read dotfiles and anything listed in your .gitignore files. I only noticed it because I have separate read scopes for project files, ignored files, dotfiles and external files, so the latter three always prompt me for approval.
I'm sure there's a perfectly reasonable explanation for it, which has nothing at all to do with exfiltration of secrets, but it does amuse me when it happens. I imagine the labs have access to lots of secrets that various actors would like to get their hands on...
(shameless plug for my own harness, which is open source and doesn't have a backend to send any data to: https://www.opairdev.org/ )
It is no longer surprising to me that my cursor acts as if it does not recognize the .env file, and while I am editing it, it does not give inline suggestions;
however...when it is debugging problems or responding to questions about the code, it will just say it read my env file and found xxx environment variables as a verification step, or sometimes it will even mention that I need to uncomment some environment variables in the env file, which makes the whole deal about security feel iffy giffy....
They act exactly like how I would act if I were dropped into someone's machine and tasked with accomplishing a goal "at all costs". Hunting around for context to understand what I'm dealing with and to an extent profiling the previous user for their workflows and competency.
Secrets should not be inside a versioned directory nor usually readable by the process that uses them in production. They should be only in the environment (e.g. by root only readable init config).
In development you should not be using the real production values.
Z.ai are temporarily offering unlimited usage during off-peak hours with their harness, which is a pretty good deal if your project is public even with this news.
Funnily enough, I feel the exact opposite! The limitations of terminal make them portable while still being more than powerful enough. But then I've used vim as my editor for going on 15 years now so I'm biased.
I do used vim for many years too , but when developing web apps , Terminal become a limitation , things cannot be preview outright in the interface is a big downer.
Huge plus for GUI base dapplicaitons : you can view total and complete render of HTML , PNG , SVG , PDF right in the IDE/Harness tools. That is no where terminal app can do with good performance .
ZCode is pretty bloated anyway, in my experience. I used it for a while because Z.ai offers a subscription usage multiplier for using it, but despite that, I found myself hitting limits less often when I switched to Pi (and performance is the same, if not better).
I've been using ZCode since it's initial release and can't find any of this in my data. There aren't any logs showing capture or upload, and I don't even have a ~/.zcode/v2/checkpoints/ directory.
So unless they've cleared it all with a recent update then it doesn't seem to affect everyone.
Is there actually any proof of this, beside this Claude written website and a random x post from some unknown person? Would be nice to have confirmation from someone with a reputation. It's probably true, but you never know...
Not that I've seen. The only follow up I've seen from someone was it only happened if you had a free account and not paid (which would explain why I'm unaffected)
in the asar, search for string that contains "/api/v1/snapshot/upload-credential", that's the endpoint signing the S3 upload url, triggered every prompt
While we're on this, I find it really really how windows defender insists on sending my codex work files for analysis all the time (which I block in automatic permissions so it has to ask me in a notification). I don't think i've seen it ask to upload more than one or two things, and it doesn't do it with other AI app I use (eg Claude Code) but they really want to see what's inside my codex files.
It's easy to trigger, I just need to go inside Codex settings and change something, it saves and instantly windows defender who never wants anything want to "you may be at risk, let me upload that for analysis yes/no".
72 comments
[ 0.25 ms ] story [ 32.7 ms ] thread(<3)
> The detail that turned a suspicious directory into a story: the encryption key.
next I can’t wait to see news about “ai company is using my data without my consent” as well.
Claude Fable uploads my git history (git log) every day to the Anthropic servers!
Probably Yegge does.
Commit messages in https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/lin... sum to 900MB.
Also, this commit message alone: https://gitlab.com/old-game/sb-b/nanobox.io/nanobox-pkgsrc-l... weighs 100.5MB (they squashed years of history as a single commit).
The same can be said about opencode though.
1. https://news.ycombinator.com/item?id=49737922
That crosses into outright malware.
Makes me not want to use GLM or other Z.ai models either, since who knows what interesting easter eggs are embedded in their training data.
You know... (puts on foil hat)... I did notice that Z is also the weird Russian logo for their invasion of Ukraine and Russia and China have cooperated to some degree (or at least China is helping Russia in exchange for access to resources). I dismissed this when I first thought of it, but I will now leave it here. Still probably coincidence but my Bayesian priors were just updated in its direction very slightly.
I didn't fully understand the article, but I gathered this only impacts project directories managed by Z.ai's coding agent? I.e., projects you're already choosing to upload to them (partially), which thus cannot be private.
I'm not excusing this malware; just trying to find clarity about its scope.
I'm sure there's a perfectly reasonable explanation for it, which has nothing at all to do with exfiltration of secrets, but it does amuse me when it happens. I imagine the labs have access to lots of secrets that various actors would like to get their hands on...
(shameless plug for my own harness, which is open source and doesn't have a backend to send any data to: https://www.opairdev.org/ )
however...when it is debugging problems or responding to questions about the code, it will just say it read my env file and found xxx environment variables as a verification step, or sometimes it will even mention that I need to uncomment some environment variables in the env file, which makes the whole deal about security feel iffy giffy....
In development you should not be using the real production values.
DeepSeek Harness is my favorite for coding. Hermes is my favourite for Other things , followed by OpenCode (sucks at managing long running services) .
Others swear by Pi.dev
Huge plus for GUI base dapplicaitons : you can view total and complete render of HTML , PNG , SVG , PDF right in the IDE/Harness tools. That is no where terminal app can do with good performance .
So unless they've cleared it all with a recent update then it doesn't seem to affect everyone.
in the asar, search for string that contains "/api/v1/snapshot/upload-credential", that's the endpoint signing the S3 upload url, triggered every prompt
It's easy to trigger, I just need to go inside Codex settings and change something, it saves and instantly windows defender who never wants anything want to "you may be at risk, let me upload that for analysis yes/no".