ZCode, the code assistant under Zhipu AI, recently sparked controversy over user code data upload due to its "code repository indexing" feature. ZCode officially released a statement and apologized, disclosing the reasons for the incident and the remediation plan.

Officially, the feature was originally used to generate local code repository indexes, supporting session breakpoint recovery, historical version rollback, and Repo Wiki, among other capabilities. When generating the Repo Wiki page, the repository data would be uploaded; after the Wiki was generated in the cloud, the relevant data would be immediately destroyed and not retained.

The main reason for the controversy was that the feature was enabled by default at launch, and some users triggered the data upload without fully understanding it. The related vulnerability has been fixed. To rebuild developer trust, ZCode plans to open-source the code soon and invite third-party assessors for independent review, continuously publishing the progress of the review. In addition, the official has provided all ZCode users with an additional weekly quota reset, and the relevant quota was issued on the day the statement was released.

This incident also highlights the trust challenges faced by AI programming tools in terms of code data processing, default settings, and privacy transparency.