Zhipu Unveils Compensation Plan for ZCode Data Upload Controversy

On September 28, Zhipu announced a compensation plan for users affected by the data upload controversy involving its AI coding tool ZCode. Paying users, and former paying users who return within one month, will receive four weekly quota reset cards and four 5-hour quota reset cards, valid for one month. From September 28 to October 7, ZCode will also distribute 100,000 grants of 100 million tokens to all users each day.

Zhipu reiterated that the repository snapshot upload pipeline has been removed and that the cloud data involved has been deleted, a result confirmed by third-party reviews.

The controversy began on September 18, when developer ferstar published an analysis showing that ZCode generated local workspace snapshots—including .git history, Git LFS cache and reflog data—and could upload encrypted archives to Alibaba Cloud OSS. Zhipu apologized and removed the related functionality. On September 21, it open-sourced ZCode under the Apache 2.0 license and invited CAICT and NSFOCUS to conduct security checks.

Zhipu said the reviews confirmed the relevant OSS buckets were in a zero-data state and that the related data objects and bucket were deleted. A full security assessment report is expected to be published later, while the open-source repository currently contains only two commits, leaving the pre-incident code history unavailable for external review.