Zhipu's ZCode Goes Fully Open Source with Dual-Party Audit After Security Controversy

After community reports of security issues and allegations of secretly uploading user code, Zhipu apologized on September 18 and fully open-sourced its coding agent ZCode on September 21, welcoming community review. The company also published independent audits and launched a bug bounty program.

Confirmed

The open-source release covers the desktop app, web workspace, backend, agent CLI, and runtime; the team apologized and stated necessary fixes are complete.
User data was deleted and the RepoW-related component removed from the client.
Audits by CAICT and NSFOCUS found zero data in the cloud OSS storage bucket; @AI寒武纪 reported independent testing confirming no code exfiltration.
The company denied using user data for model training.
A持续 vulnerability reporting and response process with severity-based rewards (bug bounty) was established; Zhipu's @louszbd said the team acted proactively once aware.

Why it matters

The incident demonstrates a full playbook for open-source vendors facing security trust crises: open sourcing, third-party audits, and bug bounties as transparency-driven trust rebuilding.
The dual-agency audit (zero cloud data) directly addressed the core "code exfiltration" allegation, offering a reference for data privacy discussions around coding agents.

2026-09-21 ~ 2026-09-21 · 5 related posts

Primary sources

ZCode fully open-sources code after upload scandal; independent audit finds no covert exfiltration — AI寒武纪 · 2026-09-21 13:38 (UTC+08:00)
Zhipu open-sources ZCode after security remediation, with CAICT and NSFOCUS assessments confirming data deletion — ResearchCrafty1804 · 2026-09-21 10:09 (UTC+08:00)

Z.ai open-sources ZCode coding agent, sets bug bounty after security concerns — Zai_org · 2026-09-21
Z.ai open-sources ZCode coding agent after security complaints, launches third-party review — teortaxesTex · 2026-09-21
[source] Zhipu open-sources ZCode after security remediation, with CAICT and NSFOCUS assessments confirming data deletion — ResearchCrafty1804 · 2026-09-21
[source] ZCode fully open-sources code after upload scandal; independent audit finds no covert exfiltration — AI寒武纪 · 2026-09-21
Zhipu's ZCode open-sources code and launches bug bounty after security backlash — TheZachMueller · 2026-09-21