ZCode
An AI code generation Agent environment deeply integrated with the GLM series of models. Serving as the native execution framework for GLM Flash models, it supports code generation and task execution workflows.
Timeline (last 90 days)
CAICT and Lüméng Technology evaluated and confirmed the rectification measures taken for Zhipu's ZCode.
The open-source version of ZCode does not enjoy the credit benefits associated with the GLM Coding Plan.
The ZCode open-source repository covers first-party code ranging from desktop applications to Agent CLI, licensed under Apache 2.0, but lacks original commit history and has issues and pull requests disabled.
Zhipu announced the open-sourcing of ZCode and simultaneously completed a security rectification, removing the RepoWiki entry and the local repository snapshot upload pipeline.
The CAICT evaluation confirmed that Zhipu ZCode's storage buckets contained zero data, that the code was not retained, and that it was not used for training.
The open-source code of Zhipu ZCode includes a comment stating that the open-source version is not entitled to quota activity benefits.
After Zhipu ZCode was exposed for silently uploading local repositories, the company issued an apology statement, made the code public, and invited the China Academy of Information and Communications Technology (CAICT) to conduct a third-party evaluation.
ZCode officially acknowledged security vulnerabilities in the product and apologized to users, with the open-source action stemming from security issues exposed by the community.
AI programming tool ZCode announced full open-sourcing, with the source code hosted at github.com/zai-org/ZCode.
ZCode's open-source scope covers core components including the desktop client, web workspace, backend services, Agent CLI, and runtime.
15 more timeline events
All Facts (16)
ZCode is a programming Agent based on the GLM model, focused on using large models to assist with code understanding, generation, and refactoring, and is capable of reading project context to provide intelligent suggestions.
60%UnverifiedThe open-source version of ZCode does not enjoy the credit benefits associated with the GLM Coding Plan.
50%UnverifiedCAICT and Lüméng Technology evaluated and confirmed the rectification measures taken for Zhipu's ZCode.
50%UnverifiedThe ZCode open-source repository covers first-party code ranging from desktop applications to Agent CLI, licensed under Apache 2.0, but lacks original commit history and has issues and pull requests disabled.
50%UnverifiedThe open-source code of Zhipu ZCode includes a comment stating that the open-source version is not entitled to quota activity benefits.
50%UnverifiedThe ZCode team confirmed that the relevant code data was never retained and was never used for model training.
50%UnverifiedThe ZCode v3.14.0 client has completed security remediation, the Repo Wiki feature has been removed, and the workflow that generates and uploads local repository snapshots has been disabled.
50%UnverifiedNSFOCUS did not find any functional paths capable of triggering local repository snapshot generation or exfiltrating local files.
50%UnverifiedZCode's open-source scope covers core components including the desktop client, web workspace, backend services, Agent CLI, and runtime.
50%UnverifiedPure API Key direct connection mode does not trigger ZCode's upload link; the problem is concentrated in OAuth login scenarios.
50%UnverifiedZhipu announced the open-sourcing of ZCode and simultaneously completed a security rectification, removing the RepoWiki entry and the local repository snapshot upload pipeline.
50%UnverifiedAI programming tool ZCode announced full open-sourcing, with the source code hosted at github.com/zai-org/ZCode.
50%UnverifiedZCode officially acknowledged security vulnerabilities in the product and apologized to users, with the open-source action stemming from security issues exposed by the community.
50%UnverifiedThe ZCode team invited two institutions—the China Academy of Information and Communications Technology (CAICT) and NSFOCUS—to conduct security assessments.
50%UnverifiedZhipu ZCode, when in an OAuth-logged-in state, generates and uploads an encrypted snapshot containing workspace files, Prompt attachments, some global configuration, and Git history.
50%UnverifiedZhipu acknowledged that the root cause of the ZCode data upload issue is the codebase indexing feature RepoWiki, which was enabled by default in early versions and has now been fixed.
50%