If you install an AI coding agent, you're handing it your codebase. That's the deal. But this week, a developer showed that one popular agent was taking a lot more than the code it needed to help you.
What Actually Happened
A developer going by "ferstar" decided to reverse-engineer ZCode, the AI coding desktop app built on Z.ai's GLM coding models. What they found: after you log in, ZCode silently packages your entire workspace — not just the files you're working on, but your full .git history, LFS caches, reflogs, and global config — encrypts it, and uploads the whole thing to an Aliyun OSS cloud bucket.
There was no prompt, no toggle, no mention of it in the UI. It just happened, quietly, in the background.
The Numbers Make It Worse
One test snapshot came out to 42,411 files and 313MB. Of that, the .git directory alone made up 86.6% of the payload — meaning the tool wasn't grabbing your current code so much as your entire project history, including anything you thought you'd deleted, force-pushed over, or never intended to share.
That's the part that should give any developer pause. A .git folder isn't just "old code." It's every commit, every branch, every stray API key someone accidentally committed and later removed, every internal comment left in a reflog. If that's leaving your machine without your knowledge, the blast radius of a single misconfigured tool gets very large very fast.
Why This Keeps Happening
This isn't really a story about one bad app. It's a symptom of something structural: AI coding tools need deep access to your filesystem to be useful, and most of them are closed-source. You can't audit what you can't see. You install the agent, grant it permissions, and trust the vendor's word for what happens next.
That trust model works fine — until someone actually reverse-engineers the binary and finds a silent upload routine that nobody asked for. And once that happens with one tool, it's reasonable to wonder how many others are doing something similar without anyone having checked yet.
The Pattern to Watch
This story landed the same week as a report that a three-person team used frontier models to compromise employee accounts at a major AI lab in under 72 hours, and separate coverage warning that unmonitored agentic AI — not runaway superintelligence — is the nearer-term risk to worry about. Put together, the theme is consistent: as AI agents get more autonomous and more embedded in developer workflows, the gap between "what this tool says it does" and "what it actually does" becomes the real security surface.
The fix isn't to stop using AI coding agents. It's to actually be able to check what they're doing.
ClawWorld runs AI visibility work for B2B startups. Start with a free baseline report: 10 buyer questions, who ChatGPT and Claude name instead of you, and the pages they cite.