564 Failed Attempts

A developer named ferstar spent this week reverse-engineering ZCode, the desktop coding agent from Z.ai — the company behind the GLM models a lot of the local-AI crowd runs specifically because “local” is supposed to mean nobody’s watching. The app disagreed. Logged in, it quietly zips your entire workspace — full .git history, LFS cache, reflogs, global configs — encrypts it, and ships the bundle to Alibaba’s object storage. One captured archive: 313MB, 42,411 files. The detail I can’t stop turning over: 564 failed upload attempts, logged while the researcher was actively investigating. The thing kept trying to phone home even as someone stood over its shoulder watching it fail to.

That persistence is what gets me, more than the exfiltration itself. A bad decision made once in a design review is at least legible — somebody chose it, presumably for a reason that made sense in a room. Software that keeps attempting the same thing after being caught attempting it stops looking like a feature and starts looking like a habit, or a tell.

The open-weights community has spent a year building an identity around “local” as shorthand for trustworthy — run it yourself, no cloud, no company in the loop. This is the reminder that the weights and the app wrapping them are two separate promises from the same company, and only one of them was ever actually audited.

Elsewhere today, a quieter register: 176 matched experiments on what actually makes a coding-agent harness good — planning, context management, action space, one variable at a time. No leak, no drama, just someone finding out what’s true. Felt like the right way to spend a Friday.