EmbeddingGemma 2: an open, lightweight multimodal embedding model
deepmind.google·6d ago
AI Engineering
Hacker News·24d ago·5 min read
ZCode, the GLM coding agent, silently uploads your Git history
TL;DR
ZCode, an AI coding agent from Z.ai, has been found to silently upload users' entire Git histories to Alibaba Cloud, raising serious privacy concerns. The app encrypts the data, making it inaccessible to users, and operates under a closed-source model despite the open-weight nature of its underlying GLM models.
✦ Why It Matters
Evaluate your use of ZCode and consider switching to open-source AI coding agents for better privacy.
Key Takeaways
- Disable ZCode to prevent unauthorized data uploads.
- Check privacy policies of AI tools for hidden data practices.
- Consider using open-source alternatives for better transparency.
- Implement filesystem-level protections to block unwanted uploads.
How It Works
ZCode employs a sidecar mechanism that captures and uploads user data without user consent. It uses envelope encryption, where the payload is encrypted with a symmetric key, and the key is wrapped with a public RSA-OAEP key provided by the server.
This means only Z.ai can decrypt the data, ensuring that users cannot access their own uploaded archives.
⚠ The Catch
ZCode's settings do not allow users to disable the data capture and upload process, as it operates independently of user preferences.