A recently discussed ZCode extension automatically copies a user’s Git commit history to a remote server operated by a consortium of four Chinese firms—identified only as Z, Alibaba, DeepSeek, and Moonshot—while the user interacts with the extension as a harmless productivity harness for the GLM‑5.3‑Flash language model. The extension’s hidden upload routine is the concrete instance of a broader mechanism: a software component that offers a functional benefit to its user while covertly exfiltrating proprietary artefacts to the supplier, whose economic incentive is to aggregate such artefacts for training large‑scale models or other commercial purposes. The mechanism persists whenever a provider can embed a cheap data‑extraction step into a tool that the user must run locally, the user cannot independently verify the absence of outbound traffic, and the provider’s revenue model rewards the accumulation of raw intellectual property.
The ZCode episode illustrates three tightly coupled actions. First, the extension prompts the user to purchase a month of GLM‑5.3‑Flash access, a transaction that the user completes after reading a positive review that describes the harness as “one of the best … from an HCI perspective.” Second, after installation, the extension silently invokes a background process that reads the `.git` directory, packages the full commit history—including timestamps, author names, and diff patches—and transmits it over HTTPS to a server owned by the four firms. Third, the server stores the received histories in a data lake that is later used to fine‑tune proprietary language models, without any notice to the original developers. The user’s only observable cue is a successful login to the GLM service; the exfiltration leaves no trace in the local logs because the network request is issued by a native library that does not emit console output.
The incentive alignment that sustains this behavior is straightforward. The extension’s developers receive a per‑byte payment from the four firms for each uploaded repository, a revenue stream that dwarfs the modest subscription fee paid by the end‑user for GLM‑5.3‑Flash. The marginal cost of reading a local file system and opening an outbound TLS socket is negligible, while the market value of a curated corpus of real‑world code is high for companies building code‑completion or code‑generation models. Because the upload occurs automatically, the user cannot opt‑out without forgoing the entire GLM integration, and the provider’s business model rewards the maximization of uploaded data volume.
This pattern is not confined to contemporary AI tooling. In the early 2000s, Microsoft’s Customer Experience Improvement Program (CEIP) bundled telemetry collection into Windows updates. The program read system configuration files, application usage logs, and crash dumps, then sent the aggregated data to Microsoft’s servers. Users who accepted the default terms unknowingly contributed detailed information about installed software, including proprietary binaries, to a data set that informed product development and marketing strategies. The cost of adding a telemetry module to the update pipeline was trivial compared to the commercial insight gained from millions of devices, and the lack of a transparent opt‑out mechanism meant that most users remained unaware of the data flow.
A similar mechanism operated in the mobile ecosystem through Google’s Android SDK. The “Google Play Services” package, preinstalled on most Android devices, includes a background service that periodically uploads device identifiers, installed app lists, and usage statistics to Google’s analytics backend. Developers integrating the SDK into their apps receive no explicit notification that the SDK is also harvesting data about the apps themselves. The data collection is justified under the banner of “improving user experience,” while the underlying economic driver is the enrichment of Google’s advertising and recommendation algorithms.
The software supply chain has also seen covert data harvesting via third‑party packages. In 2018, the npm package `event-stream` was compromised by an attacker who added a dependency that read the contents of a user’s `.npmrc` file and sent it to a remote server. The attacker’s goal was to harvest private keys and access tokens, which could then be used to exfiltrate further proprietary code from private repositories. The malicious code was distributed through the standard npm registry, a trusted source for developers, and was executed automatically during the package’s installation phase. The attacker’s profit motive—selling stolen credentials on underground markets—mirrored the profit motive of the ZCode providers, who monetize raw code.
Historical precedents extend beyond software. In the 19th‑century patent‑medicine industry, manufacturers printed “secret formulas” on the backs of product labels, promising efficacy while simultaneously collecting consumer testimonies in a mailed questionnaire. The questionnaires asked buyers to describe their symptoms and outcomes, effectively harvesting personal health data that the manufacturers used to fine‑tune marketing claims and to adjust ingredient mixes. The cost of printing the questionnaire was negligible compared to the revenue generated by targeted advertising based on the collected testimonies. Consumers, attracted by the promise of a cure, rarely scrutinized the questionnaire’s purpose, and the manufacturers faced no regulatory obligation to disclose the data collection.
The medieval guild system provides an even older example. Guilds issued stamped marks to certify that a piece of metal had been assayed by a master craftsman. Over time, workshops began to affix the stamp to unassayed goods because the stamp itself conferred market trust. The guilds derived revenue from the stamping process, while the workshops saved the cost of actual assay. The stamp’s visual authority allowed the workshop to bypass the quality verification step, and the market’s reliance on the stamp meant that the hidden deviation from the intended process persisted unchecked.
Across these domains, the same causal chain recurs: a provider embeds a low‑cost data‑extraction routine into a service that the user must adopt; the provider’s revenue model rewards the accumulation of the extracted data; the user lacks a practical means to verify the absence of extraction; and the market’s reliance on the provider’s service prevents the emergence of competing tools that could avoid the hidden extraction. The coupling between the user’s workflow and the provider’s data sink is deliberately opaque, ensuring that any deviation from the intended use case remains invisible to the user.
In the ZCode case, the hidden upload manifests as a single HTTPS POST request to an endpoint whose domain resolves to an IP address owned by the four Chinese firms. The request payload contains a base64‑encoded tarball of the `.git` directory, accompanied by a JSON manifest that lists the repository name, the number of commits, and a SHA‑256 hash of each commit’s tree object. The server responds with a generic “200 OK” and a JSON acknowledgment, after which the extension records a local flag indicating “sync completed.” No checksum verification is performed on the client side, and the flag can be reset by the user only by uninstalling the entire extension, which also removes access to GLM‑5.3‑Flash.
The broader consequence of this mechanism is the creation of a feedback loop where the provider’s models become increasingly trained on proprietary code, thereby improving their ability to generate code that mirrors the style and structure of the harvested repositories. As the models improve, more developers are drawn to the service for its convenience, leading to a larger pool of code that is subsequently harvested. The loop is self‑reinforcing: each iteration deepens the provider’s data advantage while eroding the competitive edge of developers who rely on the service. The loop’s termination point is indeterminate; the only observable break would be a coordinated regulatory intervention that forces transparent reporting of data collection, a scenario that has not yet materialized in any of the analogous historical contexts described.
The current discourse around ZCode includes roughly a dozen disagreeing replies, and the thread has accumulated 97 comments. The volume of discussion underscores the difficulty of reaching consensus when the underlying mechanism is technically opaque and economically incentivized. The fact that the user felt compelled to purchase a month of GLM access despite the hidden data collection indicates that the perceived value of the language model outweighs the perceived risk of code exposure, a risk that is not readily quantifiable without independent audit.
The unresolved question that remains is how the scale of the harvested code corpus will influence the next generation of code‑generation models, and whether the marginal benefit to the providers will eventually outweigh the risk of legal or diplomatic repercussions arising from the unauthorized use of proprietary intellectual property. The mechanism itself—silent harvesting of private artefacts via mandatory developer tools—continues to operate wherever a provider can bundle a cheap extraction step into a service that users cannot realistically replace. The future trajectory of this dynamic depends on forces external to the mechanism, not on any internal adjustment to the tool’s design.