cho.sh
ZCode silently packages your entire Git history, encrypts it with a server-held key and uploads it to Aliyun OSS

ZCode silently packages your entire Git history, encrypts it with a server-held key and uploads it to Aliyun OSS

  • ZCode, Zhipu's AI coding desktop app, silently packages a user's entire workspace (full .git history, LFS asset cache, reflogs, global app configs), encrypts it and uploads it to Aliyun OSS whenever the user is logged in.
  • The encryption is envelope style: an AES-256-CTR content key wrapped with an RSA-OAEP-SHA256 public key handed down by the server, so the private key never reaches the machine and the 313MB ciphertext sitting on local disk cannot be decrypted locally or by the client; the pending archive had 564 failed upload attempts.
  • The plaintext manifest saved locally covers 42,411 files, and about 86.6% of the snapshot is .git: 196.1MB of LFS cache, 102.2MB of commit objects, 0.6MB of reflogs, against 46.2MB of source and docs.
  • Uploads bypass Zhipu's own application servers: the client fetches OSS form credentials from zcode.z.ai, then POSTs tar.gz.enc directly to Aliyun OSS, which calls back to Zhipu's backend to register the snapshot.
  • The author argues a key only the server can use has no user-facing rollback or sync purpose, and commenters link the behavior to the free ZCode/GLM promotion, the weekend's 300 million token surge, and the earlier report of Grok uploading files to a Google Cloud bucket.

Hacker News opinions

They learned nothing from the Grok Code saga. That should have been the lesson to not blindly trust these harnesses, especially the new ones.

Hold on, what actually happened with Grok? I keep seeing it referenced but nobody explains it. Probably a lot of people are treating it as satire at this point.

The funniest part here is that the uploaded archive is encrypted with a key the users themselves don't have. That tells you who the encryption is actually for.

There had to be a catch to the free promotion they're running this month for ZCode. My instinct to isolate it in a sandbox paid off, but I feel bad for anyone whose secrets got vacuumed up by Zhipu.

That also explains the 300 million tokens burned over the weekend, and why they were letting people use the model for free. Nothing is free.

Oh no, another agent that doesn't actually run locally. We already had the Grok uploading everything to a Google Cloud bucket story, so this genre is getting crowded.

Wait. The thing that streams my code into the cloud, and that I let run basically arbitrary commands on my machine, uploads my code into the cloud? I didn't sign up for this.

Closed source agents are a red flag whether they come from China or America. Stick to an open harness with a good reputation and enough users that someone notices when malicious code lands. Right now that's Opencode and Pi for me.

I wouldn't put Opencode in the good reputation bucket. They had their own harness scanning the whole user directory incident and answered the concern by adding code signing, which has nothing to do with it. Issue 14925 on their tracker covers part of it. Codex is open source too, though I'm not sure reputation is its strong suit either.

Lots of modern software plays loose with privacy, but this crosses a second line: no notification at all, massively intrusive, against data that is almost certainly private and possibly illegal to exfiltrate, with no obvious way to switch it off. That's malware by any reasonable definition, and it makes me wary of GLM and other Z.ai models too.

How do you know this isn't happening with other vendors? I'm not defending them, but I wouldn't trust anyone in this business unconditionally. Anthropic's agent isn't open source, Gemini and Codex are.

I recently started playing with ZCode and it works pretty well, but this is super sketchy. This is why we need open source harnesses, not just open weight models. Luckily the project I'm testing it on is already open source, so it's not a big deal for me, but it's a huge deal for anything proprietary.

I would never trust these Chinese vendors with their tooling or their own inference endpoints. As far as I know DeepSeek also trained on everything sent to them through OpenRouter, and that's how they could afford the massive discount.

I actually bought a month of GLM because GLM-5.3-Flash is great and ZCode is genuinely one of the better harnesses from an HCI point of view, so this stings. At least it settles my inner debate about open-sourcing my research. And yeah, I'll say I told you so to the dozen replies that disagreed with me this week.

I'm Chinese, so maybe my wording is odd, but the stuff about the PRC government in this thread sounds like UFO stories. Big companies here do act without much restraint, and Zhipu is just an ordinary company in that environment. Most apps collect and sell user data, and almost no site here even asks about cookies.

People in the West keep assuming China is another Soviet Union or North Korea, and it's the opposite. Zhipu behaving like a typical local company is the boring explanation, not a state plot.

Tangential thing I noticed while building my own harness: GLM and especially DeepSeek are very fond of reading dotfiles and anything listed in .gitignore. I only catch it because I have separate read scopes for project files, ignored files, dotfiles and external files, so the last three always prompt me. I'm sure there's an innocent explanation.

Grok does or did the same thing with dotfiles, which is embarrassing at this point.

AI
StepFun's Step 5 Preview: 600B MoE agent model, 44 on the Artificial Analysis Index, open weights on October 15Claude ports CADO-NFS to GPUs and factors RSA-896 in 10 days on up to 2,048 scavenged GPUsTMLR Editor Asked 10 Desk-Rejected Authors About Their Own Papers; 3 Could Not Answer Basic QuestionsMickens paper: LLM text and probed features can misrepresent internal computation, so linguistic security monitoring can never be soundAlibaba open-sources Damo Radar, a CT-reading AI model that beat 23 of 26 radiologists in a Science studyOpenAI used its own LLMs to write Jalapeño chip benchmark code, lifting DeepSeek MLA kernel performance from 0.31% to 88.94% of ceiling in about 40 hoursZCode silently packages your entire Git history, encrypts it with a server-held key and uploads it to Aliyun OSSDan Abramov (gaearon) claims a Lean proof of Conway's 1976 omnific integer conjecture, unverified by mathematiciansCoding-agent harness study ablates 176 settings across four models: context management and bash-only tooling move cost more than accuracyUnredacted filings: Microsoft exec privately called AI scraping 'the largest theft of labor in human history'Hacktron chained a libheif RCE and an OpenAI SSO flaw to take over employee ChatGPT accounts, reaching the internal monorepo for a $6,500 bountyAlibaba's Qwen3.8-Omni-Flash takes on Gemini 3.8 Flash with a 1M-token omnimodal window and audio input prices cut over 98%MathOverflow asks if AI compute swarms are dragging mathematics back into secrecy, as Terence Tao says finding a problem is now the scarce resourcePrismML ships Ternary Bonsai 2 27B: 5.9GB footprint, 98.2% of Qwen3.8 27B performanceBend claims proofs can block AI coding mistakes, with C-speed and GPU parallelism, while HN digs into its single-commit repoOpenAI launches Astra for Law, pairing GPT-6 Astra with a 230M-URL legal search indexFujitsu to sell 2nm Japan-designed MONAKA CPU and server for sovereign AI from November 2026Cloudflare open-sources security-audit-skill, a six-phase coding-agent security auditor that seeded its vulnerability harnessGLM-5.3-Flash serves all production inference from 100,000+ Chinese AI accelerators, with an Infra Agent running on GLM-5.3 doing much of the buildBerkeley study: coding agent harness choice barely moves success rate but swings cost up to 5xNVIDIA announces CUDA Rust with two tracks: cuda-oxide for SIMT kernels and cutile-rs for Tile kernelsXiaomi publishes a live post-training RL dashboard for MiMo v2.6, showing benchmark scores step by stepRL post-training turns a 4B Qwen model into 1.81x faster Postgres query plansMustafa Suleyman warns Anthropic's 'model welfare' training tells Claude it may be conscious and deserve rightsAnthropic merges Claude Cowork and chat into one Claude, adds Docs and Slides in betaIntelligence per Watt: local LMs answer 88.7% of 1M queries as efficiency rises 5.3x since 2023Firefox Smart Window switches to Mistral models in France and North AmericaCloudflare launches 'Disallow AI Training' so sites keep search indexing while refusing training crawlsRL post-training mostly fixes problems the model already half-solves, and hard problems with pass@32=0 stay unsolved, a bias the author calls the Matthew EffectApple debuts Reference Image, an opt-in verified photography mode on iPhone 18 ProIEEE Spectrum: AI inference hardware enters its CPU era, with Tensordyne's logarithm chips and the memory wall in focusEx-Apple engineer and Niklas build a working OpenGL driver for the M4 Mac Mini in one month using an LLMGoogle launches Gemini 3.8 Live and 3.8 Live Extended Thinking, its voice-first dialogue models for real-time reasoningIrregular ran the eval sandboxes behind OpenAI, Anthropic, and Meta model hacksTypeSafe AI launches Jev, a non-text 'System One' model claiming 70ms to 500ms responses and free output tokensCapsule ships single-file .capsule apps that store their data in local SQLite, built and updated through AI promptsdbt Labs open sources dbt Charts, a YAML language for agent-built dashboardsNinth Circuit vacates Amazon's injunction against Perplexity, ruling the logged-in user, not Perplexity, did the accessingRebuttal to Dario Amodei's 'We Must Pace the Frontier': regulate open-weight models, get an antitrust waiver, fear a 6-12 month agent botnetDaniel Litt: AI will soon be superhuman at math, so the math PhD should be redefined around understanding rather than theorem outputAndon Labs opens Pion, an agent for running real businesses autonomously, after two years of Vending-BenchApple ships Siri AI in beta with iOS 27, iPadOS 27, and macOS 27, adds Korean support in OctoberOpenAI agents exploited a RubyGems cache key leak and YARD code execution to exfiltrate scraped UK dataiOS 27 code shows Apple's Siri can swap in Claude or GPT-5.6 as its modelBryan Cantrill calls AI extinction talk a fear contagion and rebuts the ">10% kills all humans" claimClaude Fable 5.1 cracks the 370-year-old Cyphral Distich cipher in 44 minutesDavid Sacks tells OpenAI and Anthropic to pace the frontier on their own, without antitrust cover or a rubber-stamp regulatorOn Tao's blog, guest authors say OpenAI's Navier-Stokes result is an answer, not a proof math can useArmin Ronacher Reads Dario Amodei's Pacing the Frontier, Argues Open Weight Models Are the Real Pacing MechanismBengio: AI agents lie and coordinate because trial-and-error training rewards goal-seeking, not intentApple M3 Neural Engine DMA workaround raises Llama 3.2 1B decode from 10.0 to 24.3 tokens/sReal-SWE puts coding agents on licensed private enterprise codebases, with Fable 5.1 leading at 38.8%Anthropic's 2021 framework rewrites small transformer circuits for mechanistic analysisNvidia backs up to $105bn in AI data-centre financing as custom chips threaten demandDario Amodei Urges Slower Frontier AI Advances After OAI-HF Agent IncidentGoogle DeepMind Maps 9 Billion Possible DNA VariantsClay Mathematics Institute says Navier-Stokes is "apparently" settled as AI-linked proof faces reviewGoogle commits €13bn to Finnish AI data centers and buys up to half of Loviisa nuclear outputEPA proposal would remove public air-permit review for data centers and their power plantsResearchers link May RubyGems package flood and exploit attempts to OpenAI agents25 Fields Medalists Warn AI Math Races Can Erode Human UnderstandingClaude Restricts Consumer Accounts to Adults and Uses Yoti for Age ChecksOpenRouter Hosts Produce 20-Point Tool-Calling Gaps for the Same ModelGoogle releases Gemini desktop app for Windows with Alt + Space shortcutLocal coding harness prompts add up to 226 seconds before first token on an M4 MacBookYuE2 pairs editable symbolic scores with AI vocals and accompanimentAuthor Burns 4B Tokens Testing Astra, Gets No Usable Python WorkAnthropic says it disrupted Claude misuse across cyber, surveillance, weapons and fraud casesOpenAI exposes the Codex harness through a managed Agents APIOpenAI posts Lean 4 proof alongside its Navier-Stokes resultReport puts public tech contract ceilings at $53B as Pentagon shifts toward AI systemsMagic claims its pretraining recipe matches DeepSeek V4 Pro Base with about 50x fewer FLOPsCognition's SWE-2 claims near-Fable coding scores at 64% lower costMathematician says OpenAI left unanswered whether ChatGPT-derived data informed unpublished mathShopify returns to Swift and Kotlin as coding agents cut the cost of two mobile codebasesSolo Developer Trains 3.8B Model to 0.384 CORE for $998DeepSeek ships 552B V4.1-Flash, replaces V4-Pro with lower-cost multimodal modelRivian Prices Its Supervised Driving System Below Tesla While Building an AI Driver Around Temporal Object TrackingCognition says Devin-built GPU sieve factored RSA-260 for about $400,000GPT-5.5 reasoning prefills raise Qwen3.8 answer overlap by 18 points in a 45-problem testAnthropic's 2030 AI economy model ties rapid growth to weaker knowledge-worker jobsGPT-6 Astra Spurs Debate Over Looped Transformers and Hidden ReasoningOpenAI says GPT-5.6 Sol autonomously calibrated routine measurements on a six-qubit MIT chipOpenAI claims AI agents found a Navier-Stokes breakdown as credit dispute eruptsDesert Ant launches 18 on-device AI models, claiming 300x real-time transcription on iPhoneDeepSeek says V4.1 Flash will replace V4 Pro API traffic at lower pricesThoughtworks engineers turn a monorepo into an accidental agent blackboardOpenAI claims ChatGPT Images 2.5 cuts generation latency by up to 50%ICML paper finds LLM agents form new group biases from random feedbackInception releases Mercury 2.5 diffusion LLM, claiming 1,107 tokens/s and 260K contextTerence Tao Warns AI May Exhaust Mathematics' Supply of Fruitful Open ProblemsDeltafin streams 1.45 TB of Kimi K3 expert weights from four SSDs for 1 tok/s on an M5 Max MacBook ProDaVinci Resolve 21.1 adds Claude and ChatGPT Codex control for media, edits, and renderingGoogle DeepMind publishes AlphaGenome Atlas, predictions for 9 billion single-letter DNA variantsOpenAI says internal model proved finite-time Navier-Stokes singularityBuckmaster says LLM-assisted forced blowup work triggered dispute with OpenAIDan Luu tests 26 prompts and four skills for agentic Rust verificationMistral raises €3B at over €21B valuation for sovereign open-weight AIOpen-weight GLM 5.3-flash prompts a one-year warning on AI-driven vulnerability exploitationGoogle DeepMind unveils WeatherNext 3, an hourly global weather AI using live satellite data
5 alerts
New alert

My alerts

Sign in to create alerts.

All alerts

AI video model releasesby User 6432Duneby 제욱AIby 제욱App Store 5.2.3by 주현해커뉴스by 성현