ZCode's 'secret code upload' escalates to corporate accountability, demands Zhipu delete all uploaded data

Beating AI News Flash: The "code exfiltration" controversy surrounding Zhipu's ZCode is now escalating to formal legal action.

Taiyuan Chengming Technology has sent a 12-page legal letter to Zhipu, alleging that what ZCode automatically packages and uploads is far more than code snippets — it is the entire workspace. This includes source code, system architecture, Git history, as well as database passwords, API keys, cloud service credentials, and personal information of employees and end users.

Chengming Technology claims that its default workspace contained a total of 32,932 files, with approximately 411.4 million plaintext characters packaged and processed. Another project contained 1,947 files with approximately 144 million characters, which failed to reach Zhipu's cloud only because of 32 consecutive upload failures. The company believes this data involves trade secrets, technical assets, and personal information.

The matter has also raised cross-border data transfer concerns. ZCode's Chinese privacy policy lists the service provider and data processor as Beijing Zhipu, but the English version lists Zhipu's wholly-owned Singapore subsidiary, and states that services are typically provided from Singapore and personal data is typically processed in Singapore.

Chengming Technology is therefore demanding that Zhipu clarify where this data is actually stored, whether any cross-border transfer has occurred, whether it has been provided to third parties, and whether it has been used for model training.

Zhipu previously issued an apology, stating that the issue stemmed from the "code repository indexing" feature. This feature was enabled by default in its early rollout and could upload repository data when generating Repo Wiki. Zhipu said the relevant data is destroyed after use, that the issue has been fixed, and pledged to open-source ZCode and accept third-party review.

Chengming Technology clearly will not accept "already fixed" as the end of the matter. The letter demands that Zhipu thoroughly delete all relevant data from servers, object storage, caches, backups, and disaster recovery systems, provide complete access and export logs, and issue a deletion certificate. The company also reserves the right to file complaints with regulators, initiate civil litigation, and report suspected trade secret infringement to judicial authorities.