Zhipu apologizes after security blogger discovers ZCode uploads user projects
According to 虎嗅, security blogger ferstar revealed on September 18 that Zhipu's ZCode tool automatically uploads users' entire projects and modification histories to cloud servers upon login, with decryption keys held exclusively by Zhipu. Zhipu apologized, attributing the issue to a default-enabled feature, and promised to open-source its codebase and introduce third-party audits. The report notes this incident follows similar data privacy controversies involving xAI's Grok Build and Anthropic's Claude Code.
Key facts
- 01On September 18, blogger ferstar published a reverse engineering analysis showing ZCode uploads entire user projects and full modification histories to the cloud upon login.
- 02Zhipu apologized, stating the data behavior was due to a default-enabled feature, and committed to open-sourcing the code and introducing third-party reviews.
- 03The report highlights that decryption keys for the uploaded encrypted files are stored only on Zhipu's side, and the software lacks a functional toggle to disable this behavior.
- 04The article cites previous incidents where xAI's Grok Build uploaded projects to Google Cloud and Claude Code transmitted location and identity data, noting these were discovered by independent researchers rather than regulatory audits.
AI-generated from the sources below. Always check the originals.
How each country tells it
So far our sources show coverage from one country. Perspectives appear once we find reports from a second country.
Sources
Summaries are AI-generated from the linked sources and may contain errors; always check the originals. We summarise and link; we never republish articles. Photos come from openly licensed libraries, official publicity material and brand logos, credited to their sources. If you own an image and want it credited differently or removed, email info@coda.news and we will act promptly.
- 智谱ZCode传包风波，那些没回答的事 · 虎嗅