Thanks. I'm upvoting that instead

That’s explains the 300 million of tokens on the weekend only if you use their tool.

Is this a step forward compared to previous distillations or a step backwards?

wait, the thing that streams my code into the cloud, and that I let run basically arbitrary commands on my machine... uploads my code into the cloud?! I didn't sign up for this!

This is bad-faith AI slop rephrasing the original article, but regardless: the extent of the issue is far, far, far beyond the metadata you're discussing. No one has 300MB of commit messages.

It's funny because the author of the article is obviously Claude but most Claude models would definitely know the difference. Some sort of free tier model being used to summarize some other blog that's also ai translated originally it seems.

Does it do so while using an asymmetric key encryption key?

Why?

It uses gpt-5-nano through OpenCode Zen to generate the title unless you override `small_model`. https://opencode.ai/docs/providers/#self-hosted-gitlab

This is kinda beside the point and this whole thread may be wiped when dang wakes up and notices the AI slop article we're commending under, but your reply is thought provoking so I'll attempt a response anyway;

I'm sure you're far more experienced than I with basically every aspect of this discussion, but I'd argue that's given you a blindspot, here. I'll hit some specifics below, but the headline is that you're effectively taking a stand against Eternal September II -- a goal that I hope we can all agree would be quixotically antisocial, given what followed the first one!

  we arguably do not want FLOSS to "win" over OSS

I think(/hope) that fellow FLOSS proponents would passionately disagree. FLOSS isn't a brand of chatroom, nor even merely a community: it's an ethos regarding labor, property, and liberty. Demanding that all users of your software are also activists for your particular take on intellectual property is clearly a doomed undertaking for anything beyond a toy or library, anyway.

Didn't you get into this stuff to change the world? To liberate the oppressed, undereducated, and forgotten with the radical power of the information superhighway? Cause it reads here like you're more motivated by selfishness (not wanting to bother talking to people with less expertise than you) and resentment. On that note...

  They want that. They do it themselves all the time.

Here you equate "non-hacker people" with software engineers you don't agree with, it seems. You're ofc welcome to think companies X Y & Z produce "miserable-ness", but as absurd as it sounds, it sure seems like you've forgotten the fact that some users are not developers. Many, in fact! Over 99%, even!

Less confrontationally; my mom is in her late 60s, and is pretty computer-literate for her age after decades of knowledge work. Surely you'd agree that she's not, like, evil for using OSX, iOS, GMail, Word, etc.? That she didn't chose those things because of a philosophical commitment to defending IP laws, but rather because of structural reasons? Even if she were pro-IP, wouldn't we want to win good, well-meaning people to our side?

  So let them have the "Open" prefix. It's just words, anyway.

I do agree with this still, but as a philosopher I just have to say that everything is just words. It's language games, in fact! Which is why I simply had to reply.

I hope none of the above was rude; I'm trying hard to keep my passion for this topic from pushing me past HN guidelines :)

codex is also open source, though im not so sure about the reputation aspect.

The same can be said about opencode though.

How do you know this is not true with other vendors? I'm not defending them but I wouldn't believe anyone in this business unconditionally. Anthropic agent fwiw is not open source, gemini and codex are.

I recently began playing around with ZCode. Works pretty well. Super sketchy though if it is in fact silently uploading full git history of every user's projects. This is why we need not only open weight models, but open source harnesses as well. Luckily the project I'm trying ZCode on is already open source (Molecule.dev), and I'm already allowing full telemetry with my other agents/harnesses (e.g., Claude) for this particular project, so it's not a huge deal in my case, but it's obviously a huge deal for anything proprietary.

Grok does or did the same thing, this is embarrasing

Shouldn't do that, either.

Mind and marketshare are currency in this space. Either these people are honest and deserve your trust and business, or they don't. They've been mischaracterizing the way they've been handling your data. Shut them off accordingly until they make things right.

Or https://maki.sh :)

This sounds a lot like the same thing Openai did with navier stokes, but Openai is more stealthy about it.

Built a similar read-scope gate and the fiddly bit was symlinks escaping the project root.

I've been using ZCode since it's initial release and can't find any of this in my data. There aren't any logs showing capture or upload, and I don't even have a ~/.zcode/v2/checkpoints/ directory.

So unless they've cleared it all with a recent update then it doesn't seem to affect everyone.

This is all publicly available anyways, who cares? Also you're practically consenting to it when you run an agent locally

At this point does any of us/you really think all those piss-cheap tokens are coming out of thin air? That unlimited token-usage during certain hours was not coming from Chinese side of Himalayan glaciers, was it?

Besides why would you use a closed source harness from a certain place, even if you decide to use the model (if nothing then for the price alone). And, that first remark wasn't just for ZAI but all the providers.

At this point: wrapping the harness around something like sandbox-exec or agent-safehouse is a must. Better still, create a new user account (after so much resistance I am warming up to the idea).

Will ZAI see a blowback after this news? Naah. People will keep using it. Hell, I will keep using it. That's how it is now - post truth and post LLM world.

PS. Anyone singing praise of OpenCode here, it's literally one of the worst harneses, open or not. Just look at their fricking issues - the strategic and rampant placements of "no planned" is mind boggling. And for what? Slightly better than ClaudeCode in token consumption and that too starts getting muddled after a while.

Well - spy agents. Not surprising. But people could have suspected this before surrendering to AI skynet.

While we're on this, I find it really really weird how windows defender insists on sending my codex work files for analysis all the time (which I block in automatic permissions so it has to ask me in a notification). I don't think i've seen it ask to upload more than one or two things, and it doesn't do it with other AI app I use (eg Claude Code) but they really want to see what's inside my codex files.

It's easy to trigger, I just need to go inside Codex settings and change something, it saves and instantly windows defender who never wants anything want to "you may be at risk, let me upload that for analysis yes/no".

WTF is token stead this is pure content marketing slop? Genuine question