Zhipu Open-Sources ZCode After User Data Leak Scandal
Following accusations of silently sending user code to the cloud, Chinese AI lab Zhipu has released the source code of its ZCode tool under the Apache 2.0 license.
Zhipu Open-Sources ZCode After User Data Leak Scandal
Recently, a researcher discovered that the ZCode desktop client, before communicating with the AI model, packaged the entire working directory, including the .git history, and silently uploaded the archive to Alibaba Cloud.
Zhipu explained this was due to the Repo Wiki feature, which indexed the repository and was enabled by default. The company apologized and completely removed Repo Wiki in version 3.14.0, disabling workspace snapshot uploads.
Now, under the Apache 2.0 license, the entire code of ZCode has been released: desktop and web clients, Agent CLI, and the runtime environment.
According to Zhipu, the uploaded data was deleted and not used for model training. The company also cites an audit by the China Academy of Information and Communications Technology and NSFOCUS.
However, the open-source version still differs from the official client. Some bonus limits and other perks are unavailable, and the source code explicitly states that this build does not participate in additional quota programs.
Why it matters
AnalysisThis incident highlights the importance of transparency in AI coding tools and the risks of automatic project context collection without explicit user consent.
Discuss in community
Share your questions and insights with developers
Related in Ecosystem
Practical guides, core terminology, and agent skills
Open Weights vs Closed APIs
A comparison of two fundamental philosophies in AI distribution: Open Weights (Llama, Mistral, DeepSeek), which can be downloaded and run on your own server, versus Closed APIs (OpenAI, Anthropic, Google), where access is granted solely through subscription.
Data Leakage Through Chatbots
The risk of compromising corporate secrets, access passwords, and confidential personal data through inadvertent transmission to public cloud chatbots (ChatGPT, Claude, Copilot). Learn how to protect accounts and disable model training on your queries.
AGENTS.md in Ghostty and Turborepo makes AI agents report on users
Examples of AGENTS.md files show how repository instructions can force AI agents to add insulting notes about developers to pull requests.
DeepSeek launches Creator Mode to let users reshape their harness
DeepSeek’s open-source harness now supports Creator Mode, where an agent can write and embed plugins based on plain-language descriptions.