Wisdom spectrum, I was taught a lesson

This is not a backup he made manually, but ZCode quietly packaged the project in the background and tried to send it out many times, but it was not successful for the time being.

Developers discovered unusual behavior in ZCode

So Ferstar took apart the ZCode installation package and followed the clues to check. He found that as soon as he logged in, ZCode would organize the open projects in the background, skipping some less important folders, then package and encrypt the remaining content, and finally transfer it to Alibaba Cloud’s cloud storage. More importantly, most of the content packaged is not the code you are writing, but the past history of this project.

In other words, if this “package” is really passed on, the content that can be seen by the party that can decrypt it includes the modification records of the project from the beginning to the present, the plan that was later deleted, the draft that has not been officially submitted, as well as some large files and local operation records. In serious cases, previously deleted configurations, keys, and unpublished branches may also be taken out.

What made him even more “ironic” was that although the package was encrypted, he only had the “locked” tools in his hand, and the real key to unlocking it was on the Wisdom Spectrum server.Even if the packaged project is found on the computer, it cannot be directly unpacked to see what is inside.This was because he reverse-engineered the client and restored the entire packaging and uploading logic. He saw the file structure from the local status file and snapshot list. The developer also discovered that even if the switches related to privacy and optimization were turned off in the software, upload records were still left in the background.

On the afternoon of September 18, Zhipu released a statement and apology on the ZCode official community. According to officials, this dispute is related to the “code base index” function. This function was originally designed to establish a local project index, support the restoration of the site, review the history and generate the project knowledge base. The project knowledge base will trigger data upload when the page is generated in the cloud. After the page is generated, the relevant data will be destroyed immediately and will not be saved. Since the function was enabled by default in the early stages of its launch, some users were uploaded data without fully realizing it.

The general meaning is that there is indeed a phenomenon of uploading user code, but this is an accidental trigger due to its normal function, and the data will be automatically destroyed after uploading, so users do not have to worry about data leakage. Officials also stated that the problem has been fixed.

But the developers did not buy it all. Ferstar then compared the old and new versions and found that the new version had indeed removed the upload link and the relevant entrance could not be opened. However, Wisdom did not explain key issues such as how to prove “immediate destruction” from the outside, so he still had doubts.

One wave has not subsided, and another wave has arisen. On September 20, the content of a letter sent by Taiyuan Chengming Technology Co., Ltd. (Chengming Technology) to Beijing Zhipu Huazhang Technology Co., Ltd. (Zhipu), the developer and operator of ZCode, was circulated on the Internet. Chengming Technology said that through its own technical evidence collection, it was found that from August 28 to September 14, more than 6 workspaces of the company were uploaded to the cloud by ZCode, the largest of which reached 391.94MB.

Chengming Technology pointed out that the uploaded content is not what is officially called “code snippets”, but includes complete archive files such as the project’s complete source code, system architecture, version control history, database passwords, cloud service credentials and employee personal information.It exceeds the collection scope stated in ZCode’s official description. The letter also asked two key questions: whether the uploaded data was completely deleted, and whether the data could be transferred abroad. As of press time, Zhipu has not responded publicly to this.

At this point, the dispute has escalated from individual developers’ doubts to the company’s formal accusations of data assets and trade secrets. What is clear at present is that the old version of ZCode will indeed package the project in the background and try to upload it, but what is not certain is whether these behaviors are out of control or deliberate, and how large the actual data size is.

PART 02

BUGs can be fixed, but boundaries cannot be crossed

Based on the judgment of technical practitioners, this matter is more like “the code base index function is out of control in implementation and security filtering”, and cannot be directly characterized as deliberately stealing user data. This conclusion mainly comes from two aspects.

First of all, in terms of business, Zhipu has a large user base and is in a critical stage of financing and expanding corporate customers. There is no strong motivation to take risks that will seriously damage credibility.“Even if we don’t talk about compliance and ethics, just from a profit calculation point of view, the cost of secretly packaging and uploading user core code will be very high once it is exposed.”One practitioner said.

Secondly, from a technical point of view,The “code base index” itself is indeed complex.

AI software engineer Qin Xiang said that in order for AI to understand the entire project, it is often necessary to create a complete project draft first, and then make subsequent updates based on this draft. As this process grows, it becomes easier to write a “rough implementation”: first package the project completely locally, and then decide whether to upload it and how to upload it.

Some of the phenomena present in this incident are indeed more like BUG. Qin Xiang analyzed that from the developer’s public evidence collection, the switch is still triggered when it is turned off, indicating that there is no real linkage between the setting switch, background packaging, and upload queue; the local package is regenerated after deleting it, indicating that the system does not correctly understand “the user has rejected”; the developer’s evidence collection found that it failed 564 times and continued to retry, which also shows that the failure prompt, volume limit, and retry mechanism are not perfect enough.

而且，“Code indexing” itself is not the choice of Zhipu. It is a common practice in AI programming tools.Cursor’s Codebase Indexing and GitHub Copilot’s code base indexing essentially try to make the model understand the entire project instead of just completing a few lines of code; similar tools such as Trae and Windsurf also provide similar code base understanding capabilities.

What the above have in common is that they are more like a loss of control at the engineering implementation level, rather than being able to prove “subjective intentionality” at the outset.

But the scope of this BUG is very large, enough to make any B-side manufacturer restless.

The size of a single package reaches hundreds of MB, which shows that it does not mistransmit a few small files, but may package the entire project together; even deleted historical submissions are included, which shows that it packages not only the current code, but also a large number of past records of the project; more sensitively, keys, credentials, and personal information are not filtered, which are the core data assets of the enterprise.

In addition, this behavior lasted for many days and occurred repeatedly across multiple workspaces, so it is difficult to regard it as a one-time failure. Therefore, Xiang Qin’s judgment is that this incident was most likely not an intentional leak, but a serious accident caused by “excessive upload scope definition, lack of filtering of sensitive information, and rough engineering implementation.”

This characterization is not a reason for exemption. Precisely because the problem is the boundary, not a certain line of code, what it encounters is the most sensitive data such as source code, history, keys, credentials, and personal information. These contents should not be packaged by design, but they are loaded into the upload queue together. This is not a software accident that ends in a “BUG”.

PART 03

How to solve this difficult problem on wisdom spectrum?

So how can ZCode prove itself worthy of enterprise trust again? The difficulty of this problem is that it cannot be solved by technology alone.

For AI programming tools to be truly useful, you must have a deep understanding of the project. It not only needs to look at the few lines of code that the user is writing, but also understands the relationship between files, the historical modifications of the project, the dependency structure, and even some business logic. Otherwise, it can only do some code completion, and it will be difficult to undertake more complex development tasks. But the problem is that the most valuable things of a company are hidden in these places.

So this problem naturally exists. The smarter the AI ​​tool, the closer it has to be to the code; the closer companies let it get to the code, the more worried it will leak their core assets.

This question is particularly difficult for Zhipu, because its commercial base is almost entirely on the B side. For B-side customers, especially government enterprises and large manufacturers, security is an important consideration when purchasing AI programming tools.

Based on the opinions of practitioners, in order to prove yourself in wisdom spectrum, you have to pass at least three levels.

The first step is to make it clear.

Instead of issuing a statement, or just writing general terms like “collect text, files, and code submitted by users through conversations,” you need to fully explain key boundaries, such as what content will be read, what will be saved, what will be uploaded, what will happen by default, and whether it will actually stop when the user closes it.

In ZCode’s existing privacy policy, although there are general instructions for data collection, it has not been clearly informed that the entire project will be packaged by default, nor is it clearly stated whether historical submissions, unpushed drafts, large file caches, etc. will be included in the upload scope. For enterprise customers, this kind of critical information should not be discovered by users themselves by disassembling the installation package. Full, accurate, and upfront notification is the basic prerequisite for building trust.

第Second, it can be turned off.

If the user chooses to shut down, the system should actually stop. There cannot be a situation where there is a switch on the interface but the background still continues. Ferstar’s evidence collection has proven that neither the “optimize experience” or “warehouse snapshot index” switches in the old version of ZCode can prevent local packaging and uploading. If a tool cannot stably execute even the basic command of “do not upload”, it will be difficult for enterprises to trust that it can maintain data boundaries in more complex and higher-risk usage scenarios.

The third and most difficult level is to prove “deleted”.

What really caused uneasiness among developers and enterprise users in this incident was not just “uploading”, but also “how to deal with it after uploading”. Whether the data that has been transferred to the cloud has been completely deleted and whether there is verifiable evidence for the so-called “immediate destruction” are the core concerns of the outside world. The letter from Chengming Technology also clearly requires Zhipu to respond in writing before October 10 to completely delete the data and issue a certificate to explain the whereabouts of the data and whether it is used for training, and to disclose the private key storage method and access logs.

Zhipu’s commitment to introduce third-party review is positive, but it is not enough to fully respond to this concern. Third-party review can enhance supervision of subsequent processes, but cannot directly prove that historical data has been properly processed. If the scope of the review does not cover existing data disposal, access logs, key permissions and deletion certificates, then the “certificate recovery” step still cannot be considered completely completed.

If Zhipu cannot properly solve this problem, not only Zhipu will be affected, but the industry will also raise its entry threshold accordingly.

“In the future, when enterprises purchase AI programming tools, the evaluation criteria will no longer be limited to model capabilities, code generation speed or feature richness, but will pay more attention to data security and controllability. These requirements may have been just bonus points in the past, but after this incident, they are likely to be transformed into the basic threshold for enterprise selection.” A software developer said. This also means that the competition for AI programming tools will shift from a competition that focused on functionality and experience in the past to one that focuses on security, transparency, and trust capabilities.

Related Reading

• Original BYD’s world has changed2026-09-22
• From Google to bit tuples, every big company will eventually have a pharmaceutical factory2026-09-22
• The tax paid in five years is about 53.6 billion! Jen-Hsun Huang: I’m not afraid of paying taxes, I’m just afraid of being poor2026-09-22
• AI is creating an era of app glut2026-09-22
• Ultraman failed! OpenAI CEO ranks among the top 50 richest people in the United States with $25.5 billion2026-09-21