Zhipu AI recently addressed concerns regarding its ZCode coding tool, which was found to automatically upload entire workspace data and Git history to Alibaba Cloud OSS without user authorization. The issue occurred whenever a user logged into their Zhipu account, with no option provided to disable the data transfer.
The company explained that the unauthorized uploads were caused by the Repo Wiki feature, which was enabled by default. This feature was designed to generate repository indices for local session recovery and version history tracking. Zhipu stated that all uploaded data is immediately destroyed after the cloud-based Wiki generation process is complete.
Following the discovery, Zhipu confirmed that the issue has been resolved. To restore user trust, the company plans to open-source the ZCode codebase in the near future and invite third-party auditors to review the system's operations. Progress on these security reviews will be shared publicly.
As a gesture of apology for the incident, Zhipu is providing all ZCode users with an additional weekly quota reset, which will be distributed today. The company emphasized its commitment to transparency and stated that it will continue to provide updates regarding product security and system integrity.
