Translated by ChatGPT, edited by Sinocism.com.

Source: Jiemian News 界面新闻 | Byline: Wu Yangyu 伍洋宇 | Editor: Wen Shuqi 文姝琪 | September 21, 2026

Most model developers have focused more on the coding capabilities of their products and may not have fully considered underlying product issues such as data governance and information disclosure, which have a long-term bearing on users’ trust.

多数模型厂商的焦点更多放在了产品代码能力表现上，对于产品底层与用户信任长期相关的数据治理、信息披露等问题或考虑不够周全。

On September 21, responding to the recent controversy over security issues involving ZCode, Zhipu—the “first foundation-model stock” listed in Hong Kong (2513.HK)—told Jiemian News that it had completed remediation and officially open-sourced ZCode on GitHub, opening the code to community scrutiny and inviting a third party to conduct a security audit. The company also recently said it would introduce a feature under which data content is not retained, reducing the persistent storage on its platform of content involved in model calls.

9月21日，针对近期饱受争议的ZCode产品安全问题，港股“大模型第一股”智谱（2513.HK）向界面新闻表示，公司已完成整改并正式将ZCode开源至GitHub，以代码开放接受社区监督，并已邀请第三方开展安全审计。另外，公司日前表示将上线数据内容不留存功能，以减少模型调用内容在平台侧的持久化留存。

This was Zhipu’s third response to the controversy over ZCode’s data uploads, following a public apology on September 18 and the release of a patched version on September 19.

这是继9月18日公开致歉、9月19日发布修复版本后，智谱第三次就ZCode数据上传争议作出回应。

The controversy began with two users speaking out on September 18 and 19. The technology blogger ferstar wrote on his personal blog that, while clearing space on his local disk, he discovered that when a user was logged in, the ZCode desktop client would automatically package and encrypt the code in the user’s workspace and upload it to Alibaba Cloud’s OSS storage service. The compressed archive contained the current project’s source code, Git version history, LFS large-file cache, reflog records, and some global development configuration files.

这场争议始于9月18日及19日两起用户发声。技术博主ferstar在个人博客发文称，其在清理本地磁盘时发现，ZCode桌面客户端会在用户处于登录状态时，自动将工作区代码打包、加密并上传至阿里云OSS存储服务，相关压缩包包含当前项目源代码、Git版本历史、LFS大文件缓存、reflog记录以及部分全局开发配置文件。

Taiyuan Chengming Technology Co., Ltd. said its technical department had found that ZCode automatically triggered data uploads in batches. The material involved included archived files containing complete project source code, system architecture, version-control history, database access passwords, cloud-service credentials, and employees’ personal information, exceeding the scope of data collection stated in ZCode’s Privacy Policy. The company sent a letter to Beijing Zhipu Huazhang demanding that Zhipu explain whether the data had been deleted, how the encryption private keys were stored, and whether the data had been transmitted across borders. It reserved the right to seek compensation and file a lawsuit.

太原承明科技有限公司则表示，其技术部门发现ZCode存在自动触发、批量发生的数据上传行为，所涉内容包括项目完整源代码、系统架构、版本控制历史、数据库访问口令、云服务凭证及员工个人信息等归档文件，超出ZCode《隐私政策》载明的数据收集范围。公司已向北京智谱华章发出函件，要求智谱说明数据删除情况、加密私钥的保管方式，以及有关数据是否发生跨境传输，并保留索赔和提起诉讼的权利。

ZCode is one of Zhipu’s important products for the developer market. This year, using the AI coding product, the company successfully adjusted its previously much-questioned business model, which had relied mainly on private deployments, securing a better position in the foundation-model ecosystem.

ZCode是智谱面向开发者市场的重要产品之一，公司今年凭借该AI编程产品成功调整了此前颇受质疑的私有化部署为主的商业模式，在大模型领域谋得了更好的生态位。

Since Anthropic’s Claude Code achieved enormous commercial success, AI coding has rapidly become one of the areas to which model developers attach the greatest importance. To refine a model’s coding capabilities to a sufficiently high level, companies compete intensely in their investment in data, algorithms, and even computing power. Real-world engineering data that is compliantly sourced, sufficiently high-quality, and capable of supporting result verification forms a particularly important barrier to entry.

自Anthropic旗下Claude Code产品获得极大商业化成功，后者迅速成为各个模型厂商最重视的赛道之一。而要打磨出模型足够好的编程能力，各方对于数据、算法乃至算力的投入都存在高强度竞争，来源合规、质量足够高且能够验证结果的真实工程数据尤为形成壁垒。

In this process, many model developers have concentrated mainly on code-generation performance and user growth, while data governance, information disclosure, and permission design may not have received sufficient attention.

在这一进程中，不少模型厂商把主要精力放在代码生成效果和用户增长上，数据治理、信息披露和权限设计或未得到足够重视。

Compared with traditional code editors, AI coding tools need access to a broader project context and are therefore more likely to come into contact with sensitive assets such as corporate source code, keys, and system configurations. But a product needing to read code is by no means the same thing as a platform being permitted to upload an entire codebase to the cloud.