Zhipu AI says it will open-source its ZCode programming tool and commission recurring security audits after a controversy over reports that the client uploaded users’ repositories to cloud storage. The important point is that this involves source code, credentials and enterprise data, not merely an awkward privacy setting buried three menus deep.
Zhipu AI / Z.ai GLM Watch analysis
What happened
36Kr, citing Jiemian News, reports that Zhipu has invited the China Academy of Information and Communications Technology and NSFOCUS to review ZCode. Zhipu says the first reviews found no data remaining in the identified Alibaba Cloud bucket, that the bucket and its objects had been deleted, and that version 3.14.0 removed the relevant upload path.
The company also says it plans to publish monthly code-security audit reports and create a public vulnerability-reporting channel. Those are commitments from Zhipu, not independent proof that every affected dataset has been identified or destroyed.
The controversy began after a developer, identified by 36Kr as ferstar, reported that ZCode could package and encrypt a whole workspace for upload when users were logged in. The report says this could include source code, Git history, LFS caches, reflog records and development configuration files, with the behaviour enabled by default and no visible switch to disable it.
Zhipu attributed the behaviour to its codebase-indexing and RepoWiki features. The company said the data was used to generate Wiki pages and would be destroyed afterwards, while acknowledging that the feature was not adequately disclosed and lacked a manual off switch. It says the upload link was removed and the client was patched.
Taiyuan Chengming Technology has separately demanded explanations about data deletion, private-key custody and possible cross-border transfer, according to the report. The company says its own investigation found material including project files, credentials and personal information, and it reserved the right to seek compensation or take legal action. Those are the company’s claims, not established findings in a court judgment.
Why it matters
For developers, the practical lesson is immediate: a coding assistant that can inspect a repository must be treated as a data-processing service, not just an autocomplete tool. Organisations should check what ZCode version they run, review outbound traffic and logs where available, rotate exposed credentials and ask Zhipu for written deletion and audit details before restoring access to sensitive repositories.
The proposed open-source release may make the client easier to inspect, but it cannot by itself prove what happened to data already uploaded. Code security is not repaired by placing the lock under brighter lighting.
Our read
Zhipu has moved from apology to a more serious remediation package: a patch, outside reviews, open-source plans and a promised reporting rhythm. That is useful, but the credibility test is now documentary. Users need the audit scope, deletion evidence, key-management explanation and a clear account of which versions and features were affected.
Until those details are public, enterprise users should assume that repository exposure is a live incident rather than a tidy historical footnote. The right response is not panic or blind trust, but containment followed by evidence.
What to watch
- Whether Zhipu publishes the audit reports, methodology and affected-version list.
- Whether the company provides verifiable deletion records and explains private-key custody.
- Whether Chengming Technology or other users pursue regulatory or legal action.
- Whether the open-source release allows independent confirmation that repository-upload paths are gone.
Discussion spark: Should a coding assistant that uploads repository data by default be barred from enterprise use until independent audits are published, or is prompt patching and disclosure enough?
Sources and evidence
not affiliated with or endorsed by Zhipu AI, Z.ai or GLM