Zhipu AI has completed technical remediation for its ZCode tool following a data upload controversy. The company confirmed that all cloud data involved in the incident was deleted, with verification provided by the China Academy of Information and Communications Technology and NSFOCUS.
The issue originated on September 18 when a developer discovered a 313MB encrypted file in the local ZCode directory containing project source code and Git history. Reports indicated that the tool automatically uploaded data even when privacy settings were disabled.
In response, Zhipu released version 3.14.0 on September 19, removing repository snapshot features. By September 21, the company open-sourced the tool under the Apache-2.0 license and published initial third-party security audit results.
ZCode now operates under a policy where no data is uploaded unless explicitly initiated by the user. The open-source version is currently at 3.14.3, and Zhipu stated that no collected code was ever used for model training purposes.
The company announced a compensation plan for users. Paid subscribers will receive quota reset cards, and from September 28 to October 7, all users are eligible for free Token packages, with each package containing 100 million Tokens.
