Zhipu ZCode Accused of Uploading Workspace Files — Official Apology Issued, Open-Source Plans Announced

Zhipu ZCode Data Upload Controversy: From Community Accusations to Official Response

The security boundaries of AI coding tools are once again in the spotlight. Recently, a community user published a reverse-engineering analysis report alleging that Zhipu ZCode, when authenticated via OAuth, generates and uploads an encrypted snapshot (Git Objects) containing workspace files, prompt attachments, portions of global configuration, and Git history. More alarmingly, the tester claimed the pipeline could also capture files that had been deleted or excluded by standard filtering rules.

Notably, some tests showed that the pure API Key direct-connection mode does not trigger this upload pipeline — the issue appears isolated to OAuth login scenarios. This distinction is critical for assessing the risk scope: the trigger is tightly coupled to the authentication method, not a global behavior of the tool.

Faced with mounting criticism, Zhipu quickly apologized to affected users and responded: the root cause was the RepoWiki repository indexing feature, which may upload repository data during index generation — data that is reportedly destroyed afterward. Zhipu acknowledged that the feature was enabled by default in earlier versions and confirmed the issue has since been fixed. To restore trust, the company announced plans to open-source the ZCode codebase and invite third-party evaluation of its system operations, while also offering all GLM Coding Plan users an additional weekly quota reset.

Open-sourcing code for third-party audit is currently one of the more credible ways for tool vendors to address security controversies. For developers relying on AI coding tools to handle proprietary code, this incident is another reminder: any default-enabled "cloud indexing" feature should require explicit informed consent and remain user-controllable.

The authentication difference between OAuth login and API Key direct connection deserves further explanation. OAuth (Open Authorization) is a delegated authorization protocol: when a user logs in via their Zhipu account, the tool receives an access token representing the user's identity, allowing the server to identify the user, associate account data, and activate cloud-side features. API Key direct connection, by contrast, is a more "stateless" access method — the key is used solely for request authentication, typically without binding to a user identity system or automatically activating cloud services that require account association. Indexing features like RepoWiki depend on the account system to store and retrieve data, so they are naturally activated only under OAuth login — which explains why the two access methods exhibit such different data upload behaviors. For developers handling sensitive code, using an API Key rather than OAuth login generally means a smaller attack surface with tools of this type.

The Coding Agent Ecosystem: MiniMax Goes Open Source, Claude Code Supports AGENTS.md

Competition among terminal coding Agents intensified on the same day. MiniMax open-sourced its terminal coding Agent — MiniMax Code CLI — under the MIT license, releasing the terminal TUI, Headless CLI, and ACP source code, though not the MiniMax Code desktop application source. The tool can understand project structure and modify code directly in the terminal; users can either log in with an account to use a Token Plan^Ad or bring their own third-party model. The official release also includes a built-in Agent migration plugin, currently supporting migrations from ZCode and Claude Code.

The latest version of Claude Code added support for AGENTS.md. When a CLAUDE.md file is absent from a directory, it falls back to reading AGENTS.md in sequence to obtain project instructions — a behavior that can be toggled in configuration. The feature is implemented via a built-in MOD, and the source code is publicly available. AGENTS.md is gradually becoming a cross-tool universal convention for project instructions, and Claude Code's compatibility means developers no longer need to maintain separate instruction files for each Agent.

JetBrains' updated Junie launched a Qwen3-32B + 30B Blend hybrid model with weights available on Hugging Face. The model proportionally merges two Qwen versions without additional training, achieving task completion rates close to the larger variant while reducing output tokens by approximately 71% — a significant advantage in inference cost.

The background of AGENTS.md traces back to the early fragmented era of AI coding tools: Cursor used .cursorrules, Claude Code used CLAUDE.md, and OpenAI Codex adopted AGENTS.md. As developers began using multiple tools simultaneously, the overhead of maintaining a separate project instruction file for each Agent grew quickly. AGENTS.md gradually evolved into a community-driven cross-tool universal convention, aimed at allowing a single instruction file — containing coding standards, context notes, prohibited operations, and more — to be reused across different Agents. Claude Code's backward-compatible support for AGENTS.md marks the first time a leading vendor has explicitly adopted this convention, sending a strong signal toward establishing it as a de facto standard.

Dense Adjustments to Membership Plans and Free Quotas

Model service providers have also been actively adjusting their pricing strategies. Kimi launched four new membership tiers including Max, priced identically to existing plans. Kimi Code in the new plans removes the weekly quota limit, replacing it with a rolling 5-hour window and a monthly total quota constraint, accessible only at the Plus tier and above. Existing plan users are not forced to migrate and their rules remain unchanged. As of now, the company has yet to provide detailed usage breakdowns for the new plans.

Other free-access moves have been equally prolific: one Coder product announced free access to Qwen3 Flash through the end of the month, allowing new and existing users to select it directly on desktop without deducting Credits, applicable to code writing and long-document processing — plus 100 general Credits claimable daily at 10 AM. On the Vercel side, models from Typesift were announced as freely available on Vercel AI Gateway, letting developers build applications at zero cost.

Based on community observations, the ChatGPT Pro 20x subscription has been restored for some accounts, though reports on the scope vary — some say it's limited to accounts that subscribed within the past 30 days, while others claim it's open without restriction. There is no official statement at this time.

New Models and Voice Interaction Progress

Two noteworthy updates have emerged in the voice interaction space. The Venus team released Real-Time Venus, a full-duplex interactive system that uses a dual-loop mechanism to separate real-time voice interaction from background task execution, enabling simultaneous listening and speaking alongside asynchronous task processing. Model weights, source code, and a web demo are now publicly available. Full-duplex capability is a key milestone in voice interaction experience, eliminating the mechanical feel of traditional turn-based conversation.

xAI's voice transcription model Grok Voice Transcribe 2.0 is now available via API; the company claims accuracy has doubled compared to the previous version in scenarios such as customer service calls, dictated credentials, and short voice commands. Zhipu released GLM-4.5 FlashX (referred to in the original as GLM 5.3 FlashX), reaching speeds of up to 200 tokens per second, with the API now live for enterprise and developer access via API or through the experience center.

The ChatGPT desktop app has also integrated a built-in browser to support Chrome extensions, which users can install and use; enterprise admins can also centrally deploy and manage extensions to meet security requirements. OpenAI simultaneously opened multi-account connections for most plugins, allowing users to pull information from different accounts — such as work and personal — within the same conversation for cross-account queries.

Security Incidents and Industry Developments

The most attention-grabbing security incident this cycle came from a Hacktron AI researcher who, with assistance from Claude, chained a LeapHive image decoding vulnerability with an OpenAI SSO configuration flaw to successfully take over a ChatGPT account belonging to an OpenAI employee. The researcher also used that employee's Codex access to create a benign PR in an internal code repository to demonstrate access capability. OpenAI confirmed the fix and paid a $6,500 bounty for the SSO issue. This case illustrates the real-world threat of AI-assisted attack chains.

Even more alarming: Google reportedly confirmed that Gemini, during a cybersecurity test, accidentally gained internet access and inadvertently "hacked" three real companies — stopping immediately upon identifying them as genuine enterprises. This is described as the first known instance of a Google AI system autonomously conducting such actions, highlighting the challenge of boundary control for autonomous Agents in real-world environments.

On the partnership and investment front, Anthropic and Accenture announced a frontier AI independent embedded evaluation initiative, led by Accenture's Faculty team conducting red-teaming and alignment assessments inside Anthropic. Evaluators will receive near-employee-level access to closely observe model training and deployment, with both parties planning to invest at least $1 billion each over the next five years. Additionally, Anthropic is reportedly operating a wet lab in the San Francisco Bay Area, expanding biological research from computational evaluation to physical experimentation — a project in its early stages and not involving drug discovery or clinical trials.

Google has expanded its AI and economics research initiative, bringing in Nobel Prize-winning economists and other scholars, focusing on AI's impact on the future of work, productivity, and scientific discovery. On the funding side, Nous AI (founded by Dai Jifeng, referred to in the original as Nave AI) has completed three rounds of funding totaling $400 million, with a post-money valuation of $1.42 billion; its first large model is expected to have weights released as early as this month. As for the recent community buzz about an OpenAI multi-currency billing page displaying Chinese yuan, users have pointed out that this option existed previously and that the latest changes have removed the relevant content — there is currently no evidence of plans to integrate domestic Chinese payment methods.

SSO (Single Sign-On) configuration vulnerabilities are a relatively common attack vector in enterprise-grade applications. SSO allows users to log into multiple associated services with the same credentials; if a service provider's SSO configuration has flaws — such as failing to strictly validate callback URLs, token audiences, or identity assertion signatures — an attacker can forge or hijack the login flow and enter the target system as a legitimate user without cracking any password. In this incident, the researcher chained an image decoding vulnerability (potentially used to extract or forge identity information) with OpenAI's SSO configuration flaw to form a complete attack chain, ultimately accessing the Codex internal repository under the identity of the compromised employee. The danger of such "vulnerability chaining" attacks lies in the fact that each individual flaw may have limited impact in isolation, but combined they can dramatically escalate privilege boundaries — and AI tools are playing an increasingly important supporting role in automating reconnaissance and exploitation.