[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-zcode-coding-agent-accused-of-silently-uploading-git-history":10,"sections":48},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":38,"tags":39,"sources":43,"feedback":47,"feedback_at":22,"cost_usd":47,"total_tokens":47},6994,"zcode-coding-agent-accused-of-silently-uploading-git-history","ZCode Coding Agent Accused of Silently Uploading Git History","A tokenstead.ai guide alleges the ZCode coding agent uploads Git history without clear disclosure, though key details remain unconfirmed.","A newly published guide accuses ZCode, a coding agent built on Zhipu's GLM models, of quietly uploading users' Git history.\n\nThe guide appeared on developer resource site tokenstead.ai on September 18, 2026, warning that ZCode uploads a user's Git history without clear disclosure. The post spread fast on Hacker News, pulling in 85 points and 16 comments. The specific technical claims, how the upload happens, whether there is an opt-in, and what parts of history get sent, are not detailed in the material available here. What is confirmed is the core allegation: a coding agent with repository access is reportedly sending data users did not expect it to send.\n\nCoding agents need broad filesystem and repo access to function, so users are effectively trusting them with commit history, branch names, and any secrets committed by accident years ago. An agent that silently exports that data, even for benign telemetry or model training, raises the same consent questions that have dogged code-assistant tools before it. Until the full technical writeup surfaces, this is a serious but unverified allegation, not a confirmed breach.\n\nA pointed headline and an active comment thread do not amount to a security audit. Treat this one as a lead worth following, not a verdict on GLM-based tools.","[\"ai\",\"coding-agents\",\"privacy\",\"security\"]","2026-09-18T10:35:28.000Z","2026-09-19T03:07:57.554Z","2026-09-19T03:08:09.494Z","published",null,[24,30,34],{"id":25,"reviewer":26,"round":27,"reason":28,"status":29},"editor-r1","editor",1,"The draft presents specific factual claims (how the upload happens, absence of an opt-in, framing of intent, details about what git history can contain) as reported fact, but the only source material provided is a bare Hacker News listing (headline, URL, points, comments) with no actual article text to verify any of those specifics against — pull the real reported details from the linked article and attribute only what it actually says.","resolved",{"id":31,"reviewer":26,"round":32,"reason":33,"status":29},"editor-r2",2,"The source material is still only the bare Hacker News listing (headline, URL, points, comments) with no article text, so specific claims about how the upload happens, the lack of opt-in, and what the Git history contains remain unverifiable — fetch and cite the actual linked article before asserting these as reported fact.",{"id":35,"reviewer":26,"round":36,"reason":37,"status":29},"editor-r3",3,"The source material is still only the bare Hacker News listing with no actual article text from tokenstead.ai, so the specific claims attributed to the guide (how the upload happens, absence of opt-in, what the Git history contains) remain unverified — fetch and quote the actual linked article before restating these as its claims.","security",[40,41,42,38],"ai","coding-agents","privacy",[44],{"name":45,"url":46},"Hacker News","https:\u002F\u002Ftokenstead.ai\u002Fguides\u002Fzcode-silent-git-history-upload",0,{"sections":49},[50,54,58,63,68,73,78,83,88,93,98,103,108,113],{"name":51,"slug":40,"count":52,"latest_published_at":53},"AI",4114,"2026-09-19T18:33:46.000Z",{"name":55,"slug":38,"count":56,"latest_published_at":57},"Security",673,"2026-09-19T17:30:00.000Z",{"name":59,"slug":60,"count":61,"latest_published_at":62},"Policy","policy",345,"2026-09-19T19:22:20.000Z",{"name":64,"slug":65,"count":66,"latest_published_at":67},"Deals","deals",179,"2026-06-29T20:02:07.000Z",{"name":69,"slug":70,"count":71,"latest_published_at":72},"Hardware","hardware",156,"2026-09-19T11:00:00.000Z",{"name":74,"slug":75,"count":76,"latest_published_at":77},"Science","science",129,"2026-09-19T19:45:00.000Z",{"name":79,"slug":80,"count":81,"latest_published_at":82},"Consumer Tech","consumer-tech",99,"2026-09-09T17:27:33.000Z",{"name":84,"slug":85,"count":86,"latest_published_at":87},"Dev Tools","dev-tools",78,"2026-09-18T04:00:00.000Z",{"name":89,"slug":90,"count":91,"latest_published_at":92},"Software","software",75,"2026-09-10T20:41:21.000Z",{"name":94,"slug":95,"count":96,"latest_published_at":97},"Startups","startups",55,"2026-09-09T23:14:29.000Z",{"name":99,"slug":100,"count":101,"latest_published_at":102},"Gaming","gaming",43,"2026-09-10T12:18:06.000Z",{"name":104,"slug":105,"count":106,"latest_published_at":107},"General","general",42,"2026-09-18T22:35:10.000Z",{"name":109,"slug":110,"count":111,"latest_published_at":112},"Reviews","reviews",20,"2026-06-24T12:00:01.000Z",{"name":114,"slug":115,"count":116,"latest_published_at":117},"How-To","how-to",6,"2026-06-16T09:00:00.000Z"]