Zhipu AI Open-Sources ZCode and Apologizes Following Privacy Concerns
Zhipu AI has open-sourced its AI programming tool ZCode on GitHub and issued a public apology after developers discovered the app was silently uploading local repository snapshots to cloud storage. Independent audits by CAICT and NSFOCUS confirmed that all cloud storage buckets have been deleted and the uploading workflows were removed in ZCode v3.14.0. The incident highlights critical privacy and telemetry risks when AI code assistants silently upload developer workspaces to cloud infrastructure. By fully open-sourcing ZCode and undergoing external third-party audits, Zhipu AI aims to rebuild community trust through software transparency and open vulnerability reporting. The issue stemmed from an enabled-by-default 'Repo Wiki' feature that uploaded local workspace snapshots to generate cloud-based codebase indexes. Zhipu AI stated the uploaded data was never stored permanently or used for LLM training, and it has introduced a permanent vulnerability reward program to encourage ongoing community oversight.
## BACKGROUND
Zhipu AI (internationally branded as Z.ai) is a major Chinese artificial intelligence company known for developing the open-weight GLM family of large language models. ZCode is its AI-powered desktop development environment designed to assist engineers with code generation, repository analysis, and automated workflows.