ZCode fully open-sources code after upload scandal; independent audit finds no covert exfiltration
AI寒武纪 · wechat · 2026-09-21
After community accusations that ZCode covertly uploaded user code, the vendor apologized on Sept 18 and fully open-sourced the code on Sept 21 at github.com/zai-org/ZCode, alongside security audits from CAICT and NSFOCUS confirming the cloud OSS bucket is empty and the RepoWiki snapshot-upload path has been removed.
The author cross-audited the entire repo with DeepSeek and GPT-6 Astrahigh: no logic for auto-packaging and uploading project code was found — packaging only occurs on explicit user actions (feedback with logs only, capped at 8MB/file; plugin sync; SSH transfers). Telemetry collects crash logs and metadata, not code.
Caveats remain: model requests on official plans route through the zcode.z.ai gateway; regex-based error scrubbing can't fully remove code snippets embedded in error messages; and the desktop app offers no UI toggle for telemetry, only environment variables.
More from coding & agent
- Cloudflare Talk: Swapping Some Agent LLM Calls for Fast Models Like Jev Gives Big Speedups — michellechen · 2026-11-12
- Engineer Curates 15 AI Agent Design Patterns Across Single-Agent, Multi-Agent and Feedback Tiers — MaryamMiradi · 2026-11-12
- Google Antigravity rolls out browser use, closing the loop from research to coding to live verification — rseroter · 2026-11-12
- Prettier 3.10 ships new Flow/JS syntax and a Zig-powered Yuku plugin — Vjeux · 2026-11-12
- YC-backed Graphide claims CI runner 10-20x faster than GitHub on 24 repos — ycombinator · 2026-11-12
- Lessons from a 1600-page transcription: general thinking resists staying organized — fkasummer · 2026-11-12