Zhipu Says ZCode Will Go Open Source After Code Upload Dispute

Summary

Zhipu says its ZCode AI coding tool will be formally open sourced after a dispute over the product’s handling of users’ code. The company said the China Academy of Information and Communications Technology and NSFOCUS completed an initial review. The reviewers reported that the relevant Alibaba Cloud OSS bucket contained no data, that the bucket and its objects had been deleted, and that version 3.14.0 removed the Repo Wiki entry and related generation path; they found no remaining function path for triggering local repository snapshots or file transfers. Zhipu said the open-source release is an initial response to data-processing concerns and promised monthly security-audit reports and a public vulnerability-reporting channel. The controversy began after a technical blogger said the desktop client automatically encrypted and uploaded entire workspaces while users were logged in. The reported package allegedly included source code, Git history, LFS caches, reflog records, and some global development settings, while the upload was enabled by default and lacked a visible disable option. Zhipu attributed the behavior to its codebase-indexing function, which supported rollback, checkpoint recovery, and Repo Wiki generation, and said it had removed the upload path in version 3.14.0. Chengming Technology later sent Zhipu a formal letter seeking explanations about deletion, key custody, possible cross-border transfers, audit scope, and enterprise risk controls, while reserving the right to pursue claims. Zhipu said it had apologized, offered users one quota reset, and would establish ongoing security operations. Its Hong Kong-listed shares were reported down more than 4% at the time of publication.