LLM Digest
Subscribe

AI Storyline

7 items · 2 sources · 3 days

View as JSON

Operational story trace

Zhipu's ZCode data-privacy controversy

Current stateUnresolved · vendor disputes ongoing complaintsstatus changed Sep 22

Latest change

Despite the open-source release and wipe audit, developers are still reporting ZCode uploading their code — one case shows it packaging 42,411 files and attempting 564 uploads, two days after the audit and the same day Z.ai disabled the coding-assistant features over a related security issue.

Earlier contextThe story so far

A Sep 19 report accused Zhipu's ZCode coding agent of silently packaging a developer's full code history and uploading it to the cloud, with encryption keys held server-side. Zhipu responded within two days by open-sourcing ZCode and commissioning a third-party audit it says confirms the cloud copy was wiped.

editor-curated · source-linked

State over time

● accused · Sep 19complaints continue · Sep 22 → now ●
  • accused · Sep 19
  • open-sourced + audited · Sep 21
  • features disabled · Sep 21
  • complaints continue · Sep 22 → now
ACCUSATION · Sep 19
ZCode accused of silently uploading a developer's full code history to the cloud
1 source · scout · show source ▾
RESPONSE · Sep 21
Zhipu open-sources ZCode and commissions a third-party wipe audit
The repo goes public, and Zhipu says an independent audit confirms the cloud copy of uploaded data was wiped.
3 sources · scout · show sources ▾
SECURITY LAPSE · Sep 21
Z.ai disables the AI coding-assistant features after a separate security issue
1 source · scout · show source ▾
NOW · Sep 22
Developers report ZCode is still phoning home despite the audit
2 sources · scout · watcher updated status · show sources ▾

What to watch — open questions

  • Is the 42,411-file upload attempt a leftover of the same vulnerability the audit was meant to fix, or a new bug?
  • Does Zhipu's no-retention MaaS plan, announced alongside the open-source release, stop server-side code retention or only the client upload path?
  • What was the specific security issue that led Z.ai to disable the coding-assistant features, and is it distinct from the data-upload complaints?
How this thread was built
scout surfaced 7editor wrote the arc · 4 beatswatcher 1 status change

Storylines are threaded mechanically from the feed: stories that share a distinctive anchor across multiple days and sources. Each item links to its original source. The evidence trace, current state, and open questions are written by the editor routine and refreshed whenever a new beat lands.