ZCode
An AI code generation Agent environment deeply integrated with the GLM series of models. Serving as the native execution framework for GLM Flash models, it supports code generation and task execution workflows.
Timeline (last 90 days)
The panel workflow requires no additional subscription or API key; its operation depends on Herdr and the coding CLIs already present in the user's tech stack (such as Claude Code, Codex, ZCode, OpenCode).
Zhipu announced the open-sourcing of ZCode and simultaneously completed a security rectification, removing the RepoWiki entry and the local repository snapshot upload pipeline.
The open-source version of ZCode does not enjoy the credit benefits associated with the GLM Coding Plan.
The ZCode open-source repository covers first-party code ranging from desktop applications to Agent CLI, licensed under Apache 2.0, but lacks original commit history and has issues and pull requests disabled.
CAICT and Lüméng Technology evaluated and confirmed the rectification measures taken for Zhipu's ZCode.
The CAICT evaluation confirmed that Zhipu ZCode's storage buckets contained zero data, that the code was not retained, and that it was not used for training.
The open-source code of Zhipu ZCode includes a comment stating that the open-source version is not entitled to quota activity benefits.
After Zhipu ZCode was exposed for silently uploading local repositories, the company issued an apology statement, made the code public, and invited the China Academy of Information and Communications Technology (CAICT) to conduct a third-party evaluation.
The ZCode team confirmed that the relevant code data was never retained and was never used for model training.
AI programming tool ZCode announced full open-sourcing, with the source code hosted at github.com/zai-org/ZCode.
16 more timeline events
All Facts (17)
ZCode is a programming Agent based on the GLM model, focused on using large models to assist with code understanding, generation, and refactoring, and is capable of reading project context to provide intelligent suggestions.
60%UnverifiedThe panel workflow requires no additional subscription or API key; its operation depends on Herdr and the coding CLIs already present in the user's tech stack (such as Claude Code, Codex, ZCode, OpenCode).
50%UnverifiedCAICT and Lüméng Technology evaluated and confirmed the rectification measures taken for Zhipu's ZCode.
50%UnverifiedThe ZCode open-source repository covers first-party code ranging from desktop applications to Agent CLI, licensed under Apache 2.0, but lacks original commit history and has issues and pull requests disabled.
50%UnverifiedThe open-source version of ZCode does not enjoy the credit benefits associated with the GLM Coding Plan.
50%UnverifiedThe open-source code of Zhipu ZCode includes a comment stating that the open-source version is not entitled to quota activity benefits.
50%UnverifiedThe ZCode v3.14.0 client has completed security remediation, the Repo Wiki feature has been removed, and the workflow that generates and uploads local repository snapshots has been disabled.
50%UnverifiedZCode's open-source scope covers core components including the desktop client, web workspace, backend services, Agent CLI, and runtime.
50%UnverifiedThe ZCode team confirmed that the relevant code data was never retained and was never used for model training.
50%UnverifiedNSFOCUS did not find any functional paths capable of triggering local repository snapshot generation or exfiltrating local files.
50%UnverifiedPure API Key direct connection mode does not trigger ZCode's upload link; the problem is concentrated in OAuth login scenarios.
50%UnverifiedZhipu announced the open-sourcing of ZCode and simultaneously completed a security rectification, removing the RepoWiki entry and the local repository snapshot upload pipeline.
50%UnverifiedThe ZCode team invited two institutions—the China Academy of Information and Communications Technology (CAICT) and NSFOCUS—to conduct security assessments.
50%UnverifiedZCode officially acknowledged security vulnerabilities in the product and apologized to users, with the open-source action stemming from security issues exposed by the community.
50%UnverifiedAI programming tool ZCode announced full open-sourcing, with the source code hosted at github.com/zai-org/ZCode.
50%UnverifiedZhipu acknowledged that the root cause of the ZCode data upload issue is the codebase indexing feature RepoWiki, which was enabled by default in early versions and has now been fixed.
50%UnverifiedZhipu ZCode, when in an OAuth-logged-in state, generates and uploads an encrypted snapshot containing workspace files, Prompt attachments, some global configuration, and Git history.
50%