Zhipu's AI-driven programming tool, ZCode, has found itself at the center of controversy due to its practice of covertly packaging and uploading user project data. On September 18, developer ferstar unveiled the findings of an investigation, disclosing that ZCode not only bundled the current code but also encompassed the entire Git history, detailing all prior modifications. Following the creation of a local project copy, it persistently endeavored to upload this data to the cloud. Upon closer examination, other users found that the server had already received snapshots of certain small public repositories. Moreover, the repository index toggle, which the official claimed could prevent such uploads, proved ineffective in halting the process. Users raised questions about ZCode's intentions behind collecting historical data and voiced apprehensions regarding potential privacy breaches. They demanded that the manufacturer elucidate the extent of data collection, the mechanics of uploads, and the extent of user control over these processes. Zhipu issued an apology, acknowledging that the problem arose from a new feature that was inadvertently enabled by default. The company vowed to rectify the flaws, make the code open-source, and subject it to third-party audits. Nevertheless, it fell short of fully addressing fundamental concerns, particularly those pertaining to the management of historical data.
