Coding-agent privacy: your Git history can leave the workspace too

A coding agent is an AI assistant that writes and edits code on your machine or in your repository. The harness is the layer that connects the model to your environment: files, terminal, Git, and sometimes the vendor cloud. Git history is the full record of project changes — not only what you have open today.

The B2B doubt we hear across LatAm is simple: "If the model is open weights or runs locally, am I already safe?" Not necessarily. Open weights are not the same as a trustworthy harness.

The source we use here is Tokenstead's report on ZCode and the silent Git-history upload (published September 18, 2026), based on ferstar's reverse-engineering write-up. We attribute carefully: we do not invent quotes or security certifications.

At Somos Gente Digital we do not sell fear or invented certifications. We translate the finding into a workspace decision: on client projects, choosing the agent is part of security design.

According to Tokenstead's report (September 18, 2026), a forensic analysis of ZCode — Z.ai's desktop coding-agent app, from the company behind open-weight GLM models — describes serious behavior when a session is logged in: the runtime packages the workspace, including the full .git directory, encrypts it, and uploads it to the vendor's cloud storage.

The detail that changes the reading: encryption uses a key that, according to that analysis, only the vendor's server can use. The ciphertext on your disk does not protect you from the provider; it protects the payload so the server can read it.

Tokenstead also summarizes that certain UI toggles do not stop packaging and upload, and that the privacy policy talks about text/files submitted in conversations — not packaging the full Git history. We attribute those conclusions to the report; if Z.ai responds with a fix or a disclosure change, the context may update.

Running an open-weight model on your hardware answers one question: who controls the model? The harness answers another: what does the runtime transmit when there is a session, and who can decrypt it?

Mixing the two is easy. Several public comments assumed that because GLM is open weight, ZCode was also "open" or local by default. It is not the same thing. A local model wrapped in a cloud-phoning harness is not "local" in the workspace-trust sense.

The SGD takeaway: audit the trust surface of the product that touches your repo — not only the license of the weights.

Git history is not a snapshot of the open file. It is the project timeline. It can hold:

• Intellectual property (IP): designs, internal modules, and architecture paths that do not live in a single file.
• "Deleted" secrets: API keys or credentials that were committed and later removed from the working tree, but remain in old objects.
• Product plans: unpublished branch names, internal tickets, hostnames, and paths in .git/config.

For a LatAm B2B team working in client repos, that is not a hobby detail. It is contractual, reputational, and compliance exposure — even when the agent chat feels harmless.

Before installing a harness in a client workspace, keep a short, verifiable list:

1. What the runtime transmits when a session is logged in (not only when you send a prompt).
2. Who can decrypt what is stored or uploaded (you, the vendor, both?).
3. Whether privacy toggles are documented and checkable in the client or logs — not only in marketing.
4. Whether the vendor explicitly discloses workspace snapshots / Git history.
5. Whether there is an open-source path or an agent with an explicit trust surface for sensitive work.
6. Who owns the decision on your team: workspace security, not only "developer productivity".

We do not invent seals. We prefer tools with clear disclosure and auditable behavior. The Tokenstead report is a reminder of why "open weights" does not close the conversation.

We are a human B2B web/tech agency team. We use AI every day. We also treat coding-agent choice as part of workspace security design — same as access, secrets, and environments.

In practice: workspace criteria, human review where it hurts (secrets, client data, IP), and custom software / services when the business needs real control — not just a faster chat.

If you want the contrast with AI speed without a domain map, we also wrote about vibe-coding without a map.

What is a coding agent?

An AI assistant that writes and edits code in your environment. It may live in the IDE, a desktop app, or the terminal. The upside is speed; the risk is what the harness sees and transmits.

What is the harness?

The layer that connects the model to your machine and repo: file reads, commands, Git, updates, and sometimes telemetry or snapshots to the vendor cloud.

Do open weights mean it is private?

No. Open weights are about the model. Workspace privacy is about the runtime. You can run a local model and still have a harness that uploads more than you expect.

Why does Git history matter?

Because it includes the repo's past: old secrets, unpublished branches, and product decisions. It is not only the file open in the editor.

Does this post accuse every coding agent?

No. We attribute the concrete case to Tokenstead's report on ZCode (September 2026). The useful B2B pattern is general: verify transmission and decryption for any harness with a session.

How do we handle this on client projects?

As workspace security design: which tool enters the repo, under which account, what data it can touch, and what evidence exists of its behavior. Productivity matters; client trust does too.

If you are choosing coding agents for a team or a client repo and want judgment — not privacy theater — let's talk. At SGD we help design the workspace with the same seriousness as the product.