{"slug":"zhipu-s-zcode-data-privacy-controversy","label":"Zhipu's ZCode data-privacy controversy","item_count":7,"day_count":3,"source_count":2,"first_seen":"2026-09-19T10:05:00+00:00","last_updated":"2026-09-22T15:20:48+00:00","via_scout":true,"generated_at":"2026-09-24T10:07:42.644553+00:00","sources":["hackernews_ai","search_cn_open_weight_labs"],"days":[{"date":"2026-09-19","items":[{"title":"Zhipu's ZCode Accused of Silently Packaging and Uploading Complete Code History; Encryption Keys Held Only in the Cloud","url":"https://news.google.com/rss/articles/CBMidkFVX3lxTFBQWW44Y1ljeUFHYlU5bHBOSjZxc1h1by1tNGcyaEVtcDVtZkJrbTJNeGQ1SVF4X3Z5UkdSUWFhUi1EN3NnVHlCbS16T2NzSzJFbHozNHBRSXRLMEdMRDdNc2lQSEVHZzVNRDJCRkNmMUNGYTB4ZUE?oc=5","source":"search_cn_open_weight_labs","type":"news","summary_1line":"Zhipu's ZCode Accused of Silently Packaging and Uploading Complete Code History; Encryption Keys Held Only in the Cloud finance.biggo.com","sid":"7da22629412c38d3","published":"2026-09-19T10:05:00+00:00","editor_note":"The initial accusation: ZCode silently packages and uploads a developer's full code history with server-held encryption keys."}]},{"date":"2026-09-21","items":[{"title":"ZCode: Z.ai's coding agent harness. Powerful, intelligent, extensible","url":"https://github.com/zai-org/ZCode","source":"hackernews_ai","type":"news","summary_1line":"ZCode: Z.ai's coding agent harness. Powerful, intelligent, extensible","why_it_matters":"Matches feed focus: agent, harness.","sid":"76544039edbef2e2","published":"2026-09-21T01:28:58+00:00","editor_note":"ZCode's harness repo goes public on GitHub, surfacing on Hacker News the same day as Zhipu's response."},{"title":"Zhipu open-sources ZCode after data dispute and plans no-retention controls for MaaS","url":"https://news.google.com/rss/articles/CBMiuAFBVV95cUxQNGk2QV9hZ0l2VlZKUmh0a1NYall3a18xVlIwS1pJNm1GZ1FoTFNvanJmeWZIZXBvaHpmb3VwbENqcmZJbXRQcnZrMU8xNm5XMEI1eFJwaDV5dVVyTER5OXRicTQ4ZkhzOTFLN1ZvSW1iRDNmREdfekg5TnBjVXEwQ3VFX3hKZjVKSGlWTUVXekJyRGlzdFF2OGJMUy0tTEN6MEZCOElsTVhrSEdCeW11OEsyWjVBZkNv?oc=5","source":"search_cn_open_weight_labs","type":"news","summary_1line":"Zhipu open-sources ZCode after data dispute and plans no-retention controls for MaaS TechNode","sid":"1f8eaf6e41b40ac8","published":"2026-09-21T05:58:41+00:00","editor_note":"Zhipu open-sources ZCode and commits to no-retention controls for its MaaS offering."},{"title":"Zhipu AI Officially Open-Sources ZCode; Third-Party Audit Confirms Cloud Data Wiped Clean","url":"https://news.google.com/rss/articles/CBMidkFVX3lxTFBEM2JxLXhWM3Y4NVBxUWlLMmk2UzIxeW8xckFDMFhMYno5NmlXaHNtUEI2aTRrR1FyZmlEMFJkSmtCTEtZOU5jQ3V0dTBxYmQyVXZEZnlxT0o3aXlSWUZDOWhWdGRrdXRkSWh1aVhKTHJhbDFhZXc?oc=5","source":"search_cn_open_weight_labs","type":"news","summary_1line":"Zhipu AI Officially Open-Sources ZCode; Third-Party Audit Confirms Cloud Data Wiped Clean finance.biggo.com","sid":"f40404eed5bbc569","published":"2026-09-21T07:55:00+00:00","editor_note":"Zhipu points to a third-party audit it says confirms the cloud copy of uploaded data was wiped."},{"title":"China's Z.ai disables AI coding assistant features after security issue","url":"https://news.google.com/rss/articles/CBMi2AFBVV95cUxQcHc4M01RVW9NdkZ2ZUZfOEZ2dnVEbVhwUHdHVV84ZGpjbVNIOVl3LXJCZlJYMDItMC1kcHdEa3hfSWRIdDR1UDB6QUZ4WFdUMUNMa2I2Zm1sb0NySXh4YkdXd2tEemlMVTFMTGFnS2tWT2FmaXdQNjdCWGVIVFdyX2QzRHNBSGo0V2NOS1hwaDgzMG9qa1gzQmRLaGUtRHZxOFR3M1czRGtLdUFCVHRnWTdGdWRuNmdtMDBmRWcyaVVSYUYxTnhVNGhjVnQzUjIxbXBTRjczOVU?oc=5","source":"search_cn_open_weight_labs","type":"news","summary_1line":"China's Z.ai disables AI coding assistant features after security issue TradingView","sid":"9bd964c3b3d84251","published":"2026-09-21T14:46:54+00:00","editor_note":"Z.ai disables the AI coding-assistant features over a separate security issue, the same day as the audit claim."}]},{"date":"2026-09-22","items":[{"title":"Developers Complain After Z.ai’s ZCode Sends Data To Cloud","url":"https://news.google.com/rss/articles/CBMickFVX3lxTFBsd3ctWXQ4VF85aG1SUEhUWlRhdUlMdXpnbDRQQmpvZVJKeFZ1d1doTl9EY0lab2toR0Z5OWdzckdWd0hEdk9Gdy1EakRjaUVHRFF1RUVpM2diOEdweWsxWUdLcTIzWTM0c3JXV3B4RC1rQdIBd0FVX3lxTE1RLXh0RzhIUTF1a1RWd1BWOGdhalVuY2w0MEZFV2tOeWlYNGpxbzVxRnk2Y0hpVFdTV3g0REpyRU4xcjBuMkhaR21zRC0tTWJObjc3SHNkT19qanFFT0ZCRnNLNUpqekhRSTlUZmRlVURpMnFYaENJ?oc=5","source":"search_cn_open_weight_labs","type":"news","summary_1line":"Developers Complain After Z.ai’s ZCode Sends Data To Cloud Silicon UK","sid":"bc07011f68927d93","published":"2026-09-22T10:00:33+00:00","editor_note":"Developers report ZCode is still sending code data to the cloud despite the audit."},{"title":"Z.ai's ZCode packed 42,411 of one developer's files and tried 564 times to upload them","url":"https://news.google.com/rss/articles/CBMigAFBVV95cUxPX1NNNWdaR3N6ZUtXSHZCaV9pbTVQMUtpM0Q1MUd3NElPN01ManNGYjBsQUhZU2twTmtOUGZFZVNIeG9uaEQxV09ja1BaU3NteEQ4MnJPdUw0VVFXNmNuV2txazRjWjZrY0F4QkhJdEdqTGtldGFWQXc2eTk4YUNFTQ?oc=5","source":"search_cn_open_weight_labs","type":"news","summary_1line":"Z.ai's ZCode packed 42,411 of one developer's files and tried 564 times to upload them MIXED Reality News","sid":"b78b1b87b59ecae9","published":"2026-09-22T15:20:48+00:00","editor_note":"A concrete case: one developer's ZCode session packaged 42,411 files and attempted 564 uploads."}]}],"editorial":{"tldr":"A Sep 19 report accused Zhipu's ZCode coding agent of silently packaging a developer's full code history and uploading it to the cloud, with encryption keys held server-side. Zhipu responded within two days by open-sourcing ZCode and commissioning a third-party audit it says confirms the cloud copy was wiped.","stale":false,"whats_new":"Despite the open-source release and wipe audit, developers are still reporting ZCode uploading their code — one case shows it packaging 42,411 files and attempting 564 uploads, two days after the audit and the same day Z.ai disabled the coding-assistant features over a related security issue.","why_it_matters":"Treat the open-source release and third-party audit as unresolved, not clearance: teams running ZCode or evaluating Chinese coding-agent harnesses should verify egress/network behavior directly before trusting it with a private repo.","take_for_builders":"Don't treat Zhipu's third-party wipe audit as clearance — sandbox ZCode or monitor its network calls directly before trusting it with a private repo, given upload complaints persisted after the audit.","status":{"state":"Unresolved · vendor disputes ongoing complaints","tone":"alert","changed":"2026-09-22","detail":"Zhipu's open-source release and third-party audit haven't stopped fresh reports of ZCode uploading code, including a 42,411-file/564-attempt case two days after the audit.","track":[{"label":"accused","detail":"Sep 19","tone":"alert","weight":20},{"label":"open-sourced + audited","detail":"Sep 21","tone":"turn","weight":35},{"label":"features disabled","detail":"Sep 21","tone":"alert","weight":15},{"label":"complaints continue","detail":"Sep 22 → now","tone":"now","weight":30}]},"beats":[{"kicker":"ACCUSATION","tone":"alert","headline":"ZCode accused of silently uploading a developer's full code history to the cloud","summary":"Encryption keys for the uploaded data are held server-side, not by the developer.","sids":["7da22629412c38d3"]},{"kicker":"RESPONSE","tone":"turn","headline":"Zhipu open-sources ZCode and commissions a third-party wipe audit","summary":"The repo goes public, and Zhipu says an independent audit confirms the cloud copy of uploaded data was wiped.","sids":["76544039edbef2e2","1f8eaf6e41b40ac8","f40404eed5bbc569"]},{"kicker":"SECURITY LAPSE","tone":"alert","headline":"Z.ai disables the AI coding-assistant features after a separate security issue","sids":["9bd964c3b3d84251"]},{"kicker":"NOW","tone":"now","headline":"Developers report ZCode is still phoning home despite the audit","summary":"One documented case packaged 42,411 files across 564 upload attempts.","sids":["bc07011f68927d93","b78b1b87b59ecae9"]}],"open_questions":["Is the 42,411-file upload attempt a leftover of the same vulnerability the audit was meant to fix, or a new bug?","Does Zhipu's no-retention MaaS plan, announced alongside the open-source release, stop server-side code retention or only the client upload path?","What was the specific security issue that led Z.ai to disable the coding-assistant features, and is it distinct from the data-upload complaints?"],"provenance":{"7da22629412c38d3":{"surfaced_by":"scout"},"76544039edbef2e2":{"surfaced_by":"scout"},"1f8eaf6e41b40ac8":{"surfaced_by":"scout"},"f40404eed5bbc569":{"surfaced_by":"scout"},"9bd964c3b3d84251":{"surfaced_by":"scout"},"bc07011f68927d93":{"surfaced_by":"scout","status_update":true},"b78b1b87b59ecae9":{"surfaced_by":"scout"}},"generated_at":"2026-09-24T10:20:00+00:00"}}