Zhipu open-sources ZCode after security remediation, with CAICT and NSFOCUS assessments confirming data deletion
ResearchCrafty1804 · reddit · 2026-09-21
Zhipu has open-sourced ZCode (github.com/zai-org/ZCode)—including the desktop app, web workspace, backend, Agent CLI, and runtime—and apologized for product security issues reported by the community.
Key points from the official announcement: confirmed the referenced code data was never retained nor used for model training; CAICT verified the zcode-prod Alibaba Cloud OSS bucket is in a zero-data state, and v3.14.0 removed the Repo Wiki feature and disabled local repo snapshot generation/upload; NSFOCUS confirmed all data objects and the bucket itself were deleted, with no remaining path to transmit local files externally. Zhipu will set up an ongoing vulnerability reporting process with severity-based rewards; the full assessment report is coming soon.
Related event: Z.ai Open-Sources ZCode After Security Backlash, Launches Bug Bounty(3 posts)→
More from coding & agent
- KDE Drafts AI Policy: Use LLMs, But Don't Tell Anyone — carsonfarmer · 2026-09-21
- 9 practical Jev API recipes: browser agent flies through Google Flights in 7 seconds — alexcovo_eth · 2026-09-21
- GitHub's 17.4k-Star stop-slop Teaches LLMs to Strip AI Writing Tells — tom_doerr · 2026-09-21
- Solo attorney running agent fleet: evidence gates to stop coding-agent regression loops — Specialist_Call_1257 · 2026-09-21
- Code review classification saves 122k tokens, author says even 10% savings is a free win — draginol · 2026-09-21
- Microsoft open-sources IQ Solution Accelerator unifying enterprise data, knowledge and decisions — adnan_hashmi · 2026-09-21