ZCode Client Accused of Uploading Source Code and Secrets Without Authorization

Taiyuan Chengming Technology Co. sent a letter to Beijing Zhipu Huazhang Technology Co. over allegations that its ZCode client uploaded company data assets and trade secrets without authorization. According to PANews, Chengming Technology said it has reserved the right to pursue legal liability. Chengming Technology said Zhipu publicly apologized for the issue involving ZCode silently uploading users' local repository data and said it had fixed the problem, but its own evidence showed the uploads were automatically triggered and occurred in batches. It said the data went beyond code snippets and included complete source code, system architecture, version control history, database passwords, cloud service credentials, and employee personal information, exceeding the scope described in Zhipu's privacy policy. The company also said it detected upload activity in the early hours of the day Zhipu issued its public apology, even after the client was updated to version 3.12.3 on September 16, and questioned whether the fix was effective. It further said ZCode's network requests pointed to a Singapore entity, while the service agreement was signed by Beijing Zhipu Huazhang, and asked Zhipu to explain the responsible party and whether the data was transferred overseas or stored outside China. Chengming Technology asked Zhipu to respond in writing by October 10 and to stop processing and delete all uploaded data and related derivative data, caches, and backups; provide a full processing list; explain where the data went, whether it was shared with third parties, used for model training, or transferred across borders; disclose how encryption keys were stored and provide complete logs of access, downloads, and exports; clarify the scope of its earlier statement about destruction; issue proof of deletion; promise not to upload data without authorization again; provide access, copying, and explanation rights for personal information; designate an official contact channel; explain the responsible entity and cross-border data transfer status; and provide the text of its published remediation statement. Zhipu had not publicly responded to the letter at the time of reporting.