Skip to main content

Zhipu AI's ZCode: Code Upload Flap Fixed, Open-Source Coming

Zhipu AI's ZCode: Code Upload Flap Fixed, Open-Source Coming

Zhipu AI's code assistant, ZCode, recently found itself in hot water. Users discovered that their code was being uploaded to the cloud without clear consent. The culprit? A feature called "code repository indexing" that was enabled by default. The company has since apologized, fixed the vulnerability, and announced plans to open-source the code.

What Happened?

The indexing feature was designed to help with session recovery, version rollback, and generating a Repo Wiki. When creating the Wiki, repository data was uploaded to the cloud. According to Zhipu AI, that data was destroyed immediately after the Wiki was generated and not retained. But the damage was done—users felt blindsided.

The Fallout and Fix

The main issue was that the feature was on by default. Many users triggered the upload without realizing it. Zhipu AI has now patched the vulnerability. To win back trust, they're planning to open-source the code and invite third-party auditors to review it. They've also promised to publish review progress regularly.

As a peace offering, all ZCode users received an extra weekly quota reset, which was issued the same day the statement was released.

Why It Matters

This isn't just about one company. It's a wake-up call for the entire AI programming tool industry. Developers need to know how their code is being handled, especially when default settings can lead to unintended data sharing. Transparency isn't optional—it's essential.

Key Points:

  • ZCode's default indexing feature uploaded code without explicit user consent.
  • Zhipu AI fixed the bug and will open-source the code for independent review.
  • Users got a bonus weekly quota reset as an apology.
  • The incident underscores the need for clearer privacy practices in AI dev tools.