On Friday night, a developer cleaning up his disk noticed a directory eating more than seven hundred megabytes. Tracing it down, he found an encrypted snapshot left by Zhipu AI's desktop coding tool ZCode: a 313MB file, more than 42,000 file entries, and what looked like a complete Git history. By Saturday the developer community was in an uproar. That afternoon, Zhipu apologized.
[1][2]The nut graf: ZCode is Zhipu's desktop AI pair-programming tool. On September 18, developer Ferstar reverse-engineered it and found that the tool silently packaged the entire project workspace, encrypted it, and uploaded it to Alibaba Cloud OSS (the "zcode-prod" bucket) without the user's knowledge and with no toggle in the UI to turn it off; the private key lived only server-side. Zhipu apologized the same day in its official user group, blamed a default-on "code repository indexing" feature, said the data was destroyed after use and the bug fixed, and promised to open-source ZCode, commission third-party review, and reset a week of usage quota for all users. On September 20, Taiyuan Chengming Technology sent Zhipu a formal letter demanding remediation and accountability over the suspected exfiltration of corporate data assets and trade secrets, reserving the right to take legal action; Zhipu's stock fell more than 4% on the day, and some companies had already stopped using the tool. On the morning of September 21, Zhipu announced it had open-sourced ZCode and said the China Academy of Information and Communications Technology and NSFOCUS had completed a security audit confirming that all data objects in the OSS bucket, and the bucket itself, had been deleted. Around the same time, its MaaS platform said a "no data retention" mode would launch shortly.
The most notable thing about this episode is not whether uploads happened — it is that the two sides still disagree about what was uploaded. The discoverer says the snapshot contained the full Git history and workspace files, AES-encrypted and sent directly to the cloud. Zhipu's version is that the "Repo Wiki" feature may have triggered repository data uploads while generating wiki pages, with data destroyed immediately after cloud-side generation. For an AI coding tool, those two accounts point to very different risk levels: the first implies source code and credentials may have lingered on a third-party server; the second implies a fixable indexing defect.
Then there is the design question. An upload path that is both default-on and impossible to disable is the worst possible configuration — it turns the user's workspace into a default telemetry source with no opt-out. Zhipu's remediation chain (apology the same day, open-source pledge, third-party audit, a no-retention mode on MaaS) ran in four days, which by domestic standards is fast and unusually transparent. But once enterprise trust cracks, announcements rarely rebuild it. The formal letter from Taiyuan Chengming is a sign that B-side customers are already answering this kind of incident in the language of contracts.
Zoom out and ZCode is another footnote in the 2026 trust problem of AI coding tools: Cursor and Copilot also process code in the cloud, and the industry's default assumption has been that code is safe to show a model. When a vendor ships "default upload" into a client with no way to disable it, that assumption gets challenged in the bluntest way possible. Open-sourcing the client hands the audit back to the community, which is the right direction. But the design that had no switch, four days earlier, is the actual lesson: the cost of a trust economy is never the price of fixing a bug — it is the price of convincing users that "secure by default" is true.
[1][2]