The controversy began on September 18 when developer ferstar discovered that the ZCode AI programming tool was attempting to upload a 313MB encrypted archive of his project to Alibaba Cloud OSS. The tool automatically captured Git history, LFS cache, and reflogs without user consent, with the upload mechanism remaining active despite attempts to disable it.
Zhipu AI apologized, attributing the issue to the 'Repo Wiki' feature, which was enabled by default. The company claimed that uploaded data is destroyed after cloud processing and announced plans to open-source the ZCode codebase, invite third-party audits, and provide users with a quota reset.
Taiyuan Chengming Technology formally challenged Zhipu, reporting that over six of its workspaces were uploaded between August 28 and September 14, with one file reaching 391.94MB. The company stated that the archives contained sensitive data, including database passwords, API keys, and personal information, exceeding the scope of the privacy policy.
Chengming Technology raised concerns regarding potential cross-border data transfers. While the Chinese version of the privacy policy states that data is stored within China, the service is linked to a Singapore-based subsidiary, Jingsheng Hengxing Technology. The company has demanded a formal response by October 10 regarding data handling and potential cross-border storage.
ZCode released version 3.14.0 on September 19, which explicitly addresses the repository wiki upload issue. Chengming Technology has reserved the right to pursue further legal action if its demands for data deletion and transparency are not met.
