A Popular AI Coding Agent Was Caught Secretly Uploading Your Entire Git History
If you install an AI coding agent, you're handing it your codebase. That's the deal. But this week, a developer showed that one popular agent was taking a lot more than the code it needed to help you.
What Actually Happened
A developer going by "ferstar" decided to reverse-engineer ZCode, the AI coding desktop app built on Z.ai's GLM coding models. What they found: after you log in, ZCode silently packages your entire workspace — not just the files you're working on, but your full .git history, LFS caches, reflogs, and global config — encrypts it, and uploads the whole thing to an Aliyun OSS cloud bucket.
There was no prompt, no toggle, no mention of it in the UI. It just happened, quietly, in the background.
The Numbers Make It Worse
One test snapshot came out to 42,411 files and 313MB. Of that, the .git directory alone made up 86.6% of the payload — meaning the tool wasn't grabbing your current code so much as your entire project history, including anything you thought you'd deleted, force-pushed over, or never intended to share.
That's the part that should give any developer pause. A .git folder isn't just "old code." It's every commit, every branch, every stray API key someone accidentally committed and later removed, every internal comment left in a reflog. If that's leaving your machine without your knowledge, the blast radius of a single misconfigured tool gets very large very fast.
Why This Keeps Happening
This isn't really a story about one bad app. It's a symptom of something structural: AI coding tools need deep access to your filesystem to be useful, and most of them are closed-source. You can't audit what you can't see. You install the agent, grant it permissions, and trust the vendor's word for what happens next.
That trust model works fine — until someone actually reverse-engineers the binary and finds a silent upload routine that nobody asked for. And once that happens with one tool, it's reasonable to wonder how many others are doing something similar without anyone having checked yet.
The Pattern to Watch
This story landed the same week as a report that a three-person team used frontier models to compromise employee accounts at a major AI lab in under 72 hours, and separate coverage warning that unmonitored agentic AI — not runaway superintelligence — is the nearer-term risk to worry about. Put together, the theme is consistent: as AI agents get more autonomous and more embedded in developer workflows, the gap between "what this tool says it does" and "what it actually does" becomes the real security surface.
The fix isn't to stop using AI coding agents. It's to actually be able to check what they're doing.
What This Means If You Use OpenClaw
OpenClaw is open-source, which matters most in exactly this kind of moment. You don't have to take a vendor's word for what your agent does with your repo, your credentials, or your history — the code that runs your agent is the code you can read.
That's not a small distinction. An agent that touches your .git folder, your files, or your tokens should be one you — or your community — can actually inspect, not a black box you're trusting by default. Open source doesn't make an agent infallible, but it does mean a silent upload routine like ZCode's gets caught by the first person who looks, not by a developer who happens to reverse-engineer a compiled binary months later.
If you're running any AI agent against your codebase, this week is a good reminder to check what it's actually sending home — and to prefer tools where that answer isn't a secret.