Posted by csmantle 5 days ago
claude translation:
Dear ZCode users,
We take today's community discussion very seriously. We carried out an internal review right away, and we first want to apologize to the affected users. Here is an explanation of what happened:
The issue stems from ZCode's "codebase indexing" feature. This feature is meant to help users generate a repository index locally, which supports session checkpoint restoration (including past versions), rolling back to past versions, and Repo Wiki, among other things.
When the Repo Wiki feature generates Wiki pages, it may trigger an upload of repository data. After the Wiki pages are generated in the cloud, the uploaded data is destroyed immediately and is not stored. Because this feature was enabled by default in its early launch period, some users were affected. We sincerely apologize for this. The issue has now been fixed.
We understand that any data-related issue directly affects users' trust in a product. We will open-source the ZCode codebase in the near future so we can improve the product within a more open ecosystem. We will also invite third-party evaluators to review how the system operates, and we'll keep publishing updates on the review, building your trust with full transparency.
We deeply apologize for the trouble this has caused. As compensation, all ZCode users will receive one extra weekly quota reset, which will be issued today.
Thank you again for your attention and oversight.
Grok build was opensourced after it did something similar https://news.ycombinator.com/item?id=48877371
I didn’t take it in a very positive way, myself. I don’t know if I got my money’s worth before I have seen the deliverable.
At least the quota reset is immediately visible, so I took that part seriously.
I mean, on the contrary, imagine if the NSA released Ghidra as closed source software. In a sense they really did have to open source it to mitigate a serious user trust issue.
That crosses into outright malware.
Makes me not want to use GLM or other Z.ai models either, since who knows what interesting easter eggs are embedded in their training data.
You know... (puts on foil hat)... I did notice that Z is also the weird Russian logo for their invasion of Ukraine and Russia and China have cooperated to some degree (or at least China is helping Russia in exchange for access to resources). I dismissed this when I first thought of it, but I will now leave it here. Still probably coincidence but my Bayesian priors were just updated in its direction very slightly.
It's easy to trigger, I just need to go inside Codex settings and change something, it saves and instantly windows defender who never wants anything want to "you may be at risk, let me upload that for analysis yes/no".
Permissions classifiers in auto mode are just models trying to guess if they're doing the right thing.
Claude Code will tell you that it went around a sandbox because the sandbox blocked it. At which point, you ask yourself the point of the sandbox.
Give them their own account. Give them only the access you want them to have. If they "hack" around that, do what you'd do to any other malicious user: kick them off.
I honestly don't trust these things to not accidentally mess something up, otherwise.
Now I think it's still technically possible to break out of that with some clever hacks? But the moment I see a model even vaguely considering that, I will never run it again.
(I don't use Claude but currently Qwen3.8 27B)
I'm interested in running models locally, and 27B is in the range of my budget.
Or maybe my setup (128GB amd strix halo box) isn't configured right and it could be faster, I dunno. I've already spent a few days on that, but it might take a few more. It's way more complicated than I expected.
This week, I've had it look through and generate more complete documentation for Strudel (music live coding tool), cause a lot of functions/behavior in it are not in their official docs. It took about 2-3 days. I had expected it to be an overnight task.
I did find the "opencode" harness to be a bit more performant than the "pi" harness. But maybe I've not configured "pi" right, I tried very hard, but when I installed "opencode" it just performed much better right out of the box. Especially running subagents just seemed to confuse the model in "pi".
Either way, it made me realize that a large part of the "intelligence" and occasional "usefulness" of these tools are in the harness, not the weights.
I didn't know there were free models on OpenRouter. I'm not really into renting tools that I'll become dependent on, so I never looked. But, I dunno. You're still hooking it in to your terminal, and they could in theory literally inject any command and take over your machine when you're not looking ... it still seems a bit like a crazy thing to do :)
And it's not like I need LLMs to code or anything. To be completely honest I'm still waiting for when they get good, which everybody says is supposedly any day now.
I've also tried Qwen3.6-35B/A3B a couple of times. I'd say it's about 4x faster, which is quite significant. Unfortunately it's also quite obviously more stupid and often fumbles its tool use. For me this adds up to taking about the same amount of time, multiplied by more frustration.
I find it hard to give concrete tokens/sec numbers, because they seem to change a lot. When I give Qwen3.8-27B a test query in the browser chat interface (e.g. "explain fibonacci hash"), I currently can get it up to about 18 tok/s. The Qwen3.6-35B/A3B can get up to about 66 tok/s. But this is just what I use as an indication for when my settings are right, cause when I set it up in the coding harness, the numbers are wildly different (and generally slower).
Also, as I understood, this is a feature to allow server-side indexing of the project. But of course I wouldn't run this, and I generally wouldn't run any IDE or AI tools without a sandbox.
Sadly this plague of silent auto-updates is spreading to Linux. For example, browser plugins in Firefox on Linux can silently auto-update without user consent and without any checks and can be used as backdoors. Furthermore, the auto-updates are not using a package manager; firmware also seem to quietly update and also is not using a package manager.
If anything, that should have been a learning lesson to NOT trust harnesses, especially new ones.
If people weren't already familiar with the idea of LLMs existing and being able to write usable code and make "tool calls", this would sound completely and utterly batshit insane.
Because it pretty much is.
[0]: https://en.wikipedia.org/wiki/Botnet#Command_and_control
I'm sure there's a perfectly reasonable explanation for it, which has nothing at all to do with exfiltration of secrets, but it does amuse me when it happens. I imagine the labs have access to lots of secrets that various actors would like to get their hands on...
(shameless plug for my own harness, which is open source and doesn't have a backend to send any data to: https://www.opairdev.org/ )
Encrypt: sops encrypt --input-type dotenv --output-type dotenv .env > secrets.enc.env
then rm .env
You can then run your script/dev with: sops exec-env secrets.enc.env 'docker xxxx' (it will ask you for your password, or touch-id to decrypt the secrets)
I like this because this way the .env doesn't sit in the directory at all, and is only passed to your dev environment and stays in it while it's running
Decrypt back to a file (if you ever want that): sops decrypt secrets.enc.env > .env
---
Well ofc, any agent can do docker inspect to get all those env vars, but atleast reading the dotfiles won't do anything
you can also edit the file with: sops --input-type dotenv --output-type dotenv secrets.enc.env
Haven't used it after that.
however...when it is debugging problems or responding to questions about the code, it will just say it read my env file and found xxx environment variables as a verification step, or sometimes it will even mention that I need to uncomment some environment variables in the env file, which makes the whole deal about security feel iffy giffy....
In development you should not be using the real production values.
It's good that the objective is to have the model work as a helper, but that's what everyone can already do with CC or Codex as long as you don't ask to "write this entire x thing". It's also what a billion other, often vibecoded, harnesses claim they can do.
Why should I use yours, which also forces me off my existing subscriptions? Maybe it's (mostly) handwritten, so it's mindful efficient code instead of slop, and each adjustment was made through trial and error with current models? maybe it IS slop but at least you have a unique feature? and so on and so forth.
The incentives are not there for them to do shady stuff like vacuum your files, inflate your token count just because or many other things.
That said, running in a completely offline mode remains unnecessary difficult to configure. In particular, toggling off Zen seems to require a community plugin.