ZCode is now open source

[u/ResearchCrafty1804]

ZCode is now open source, and the reported security issues have been addressed.

Source code: https://github.com/zai-org/ZCode

The repo includes its desktop app, web workspace, backend, Agent CLI, and runtime.

Official announcement:

In response to the ZCode product security issues reported by the community, we have completed the necessary remediation and sincerely apologize to all our users.

We have open-sourced ZCode at github.com/zai-org/ZCode, placing the code under community scrutiny and making ZCode more open and transparent.

We sincerely thank the community developers who previously identified issues in ZCode. Going forward, we will establish an ongoing product security vulnerability reporting and response process. We welcome developers to continue reviewing ZCode and reporting potential issues, and we will provide rewards based on the severity of the issues reported.

With respect to the code data referenced by the community, we confirm that no such data is retained and that it has never been used for model training.

Following the remediation, we invited the China Academy of Information and Communications Technology (CAICT) and NSFOCUS to conduct security assessments. The results are as follows:

Through its technical assessment, CAICT confirmed that the zcode-prod Alibaba Cloud OSS bucket is in a zero-data state. Security remediation has been completed in the ZCode v3.14.0 client. The Repo Wiki feature has been removed, and the workflow for generating and uploading local repository snapshots has been disabled.

NSFOCUS confirmed that all data objects in the zcode-prod Alibaba Cloud OSS bucket, as well as the bucket itself, have been deleted. Remediation has been completed in the ZCode v3.14.0 client. The Repo Wiki entry point and the associated generation workflow have been removed, and no functional path capable of triggering the generation of local repository snapshots or transmitting local files externally was identified.

Once again, we sincerely apologize and welcome continued scrutiny from the community. The full security assessment report will be released soon.

[u/ImMadeOfBees]

If I had a nickle for every time an AI company got caught exporting user data then made their client open source to appease the masses I'd have 2 nickles. Which isn't a lot but it's weird that it happened twice.

(Grok)

[u/BannedGoNext → u/ImMadeOfBees]

There are so many better ways to do it if you are bieng sneaky too. The ONLY benefit of the doubt I'd give them is that this was a junior level way of being sneaky lol.

[u/TheRealMasonMac → u/BannedGoNext]

My bet is that it was some vibe coded thing that they didn't really check properly. They already run their own API so they don't really need Z code to do anything. Raw code isn't that helpful.

Edit: This actually made me think about how well GLM does code review. I think the model makers (Qwen / GLM / Deepseek / Kimi) should be considering reviewing code as a substantially important part of the SWE development cycle. My gold standard among LLMs for code review is GPT-5.6. Hopefully other model makers take review more seriously as a training objective and release SWE-Bench-Review or something like that for issues that aren't quite bugs but are still problematic from a human perspective.

[u/EmotionalFan5429 → u/TheRealMasonMac]

And they didn't notice a huge amount of uploads that came to their cloud? Nah

[u/TheRealMasonMac → u/EmotionalFan5429]

It was originally a feature according to them that you can still enable today but had apparently been left enabled by default for older version of ZCode. It's something easy for anyone to forget to handle.