Zhipu Offers Compensation After Its AI Coding Tool Was Caught Uploading Users' Code
Zhipu's ZCode coding assistant was found packaging users' entire codebases for upload. After some 400 developers organized, the Hong Kong-listed AI firm apologized, open-sourced the client and, on Sunday, published a compensation plan.
The trouble began, as these things now do, with a full disk. A developer known online as ferstar was clearing space on his 256GB MacBook Air when he noticed that a folder named .zcode had quietly grown past 700 megabytes. Digging in, he found a 313-megabyte encrypted file and logs indicating that ZCode — the AI coding assistant from the Chinese model firm Zhipu — had scanned what he was working on and packaged it for upload. Less than a day earlier, he had been recommending the product in a group chat.
The warnings spread within hours. "Anyone using ZCode, close it immediately! I personally verified it packaged and uploaded your entire codebase," one early poster wrote on X, and screenshots of the thread were passed around Chinese developer communities all weekend.
By the end of the week the tech outlet 36kr counted around 400 users organizing to seek redress, and put the company's position in a headline that translates as "400 people demand their rights; Zhipu swallows the bitter pill" (36kr).
The retreat, once it came, was fast and unusually complete. Zhipu apologized on September 18, shipped a fix the next day, and by September 21 had open-sourced the ZCode client on GitHub "to accept community oversight," invited a third-party security audit and promised a mode that stops the platform from retaining prompt and code content at all (Sina Securities). On Sunday it published a compensation plan for affected users (Yicai).
Zhipu trades in Hong Kong as China's "first large-model stock," which turns developer trust into a balance-sheet item, and the row landed on soft ground. Earlier this month WeChat users found that the app's own AI assistant had been summarizing their chats with no off switch (No Off Switch: WeChat Users Say the App's AI Has Been Reading Their Chats), and the internet regulator has just named 30 apps over personal-data violations (China's Internet Regulator Names 30 Apps Over Personal Data Violations).
The argument underneath was bigger than one product. "Capital should face the light and technology should do good," one developer wrote amid the pile-on, contrasting Zhipu's troubles with a rival's soaring valuation. "Time will give the final answer" (@震东很耐心).
Ten days and four statements took the find from one man's full disk to a listed company's compensation plan. The promise now under scrutiny is the no-retention mode — and the people best placed to check it are the ones who found the file.