Zhipu to Open Source AI Coding Tool ZCode and Launch Security Audit

On September 21, Zhipu, a Chinese large-model company, announced that its AI coding tool ZCode will be officially open-sourced, calling it the first step in responding to external data privacy concerns. The company has invited the China Academy of Information and Communications Technology (CAICT) and NSFOCUS to conduct security audits.

According to CAICT's technical evaluation, the zcode-prod Alibaba Cloud OSS bucket now holds zero cloud data. NSFOCUS confirmed that all data objects and the storage bucket itself have been deleted. The ZCode v3.14.0 client has completed security rectification, with the Repo Wiki feature removed and the local repository snapshot upload path disabled.

Zhipu said the open-sourcing move is the first step in addressing external concerns, and it plans to push ZCode further toward community development, inviting users to download, inspect, and help improve the code. The company also said it will establish a routine security vulnerability reporting mechanism, offering rewards based on severity levels.

On September 20, Zhipu's MaaS platform announced it would soon launch a "no data retention" feature to reduce persistent storage of model call content, with users allowed to apply for activation. The feature does not cover BatchAPI or FileAPI, which require persistent storage, and data may be retained for 30 days or more when required by law or for compliance checks.

The privacy dispute followed social media reports that ZCode silently uploaded user coding data to third-party servers. On September 18, Zhipu explained that the issue was triggered by a default-enabled "code repository index" feature, which uploaded data only to generate RepoWiki pages in the cloud and then destroyed it. The company apologized to affected users.