Zhipu open-sources ZCode — but only the version after the fix
Zhipu did the thing it promised and published its coding agent's source. What it published starts after the bug.
Zhipu (2513.HK) pushed the full source of ZCode to a public repository on Sunday night, nine days after a developer showed the agent was packing entire workspaces and Git history into an encrypted archive only Zhipu could open. The code lives under the company's zai-org organisation, carries an Apache 2.0 licence, and declares version 3.14.0 in its package manifest. It drew roughly 2,100 stars and 520 forks within hours of going up, and the README walks through building the desktop app, the browser client and the terminal agent from source.
The history is the part that decides what the release is worth. The repository has two commits: an initial commit at 12:06 UTC and a single squash labelled "feat: open source" at 21:14 UTC the same day. There is no pre-fix code in it — no workspace snapshot uploader, no Repo Wiki generation pipeline, nothing that shows the behaviour ferstar reconstructed on his own disk. A scan of the published tree turns up no repository-snapshot or workspace-upload endpoint at all; the only upload-credential call anywhere in the codebase belongs to the feedback form's attachment path, which is a different mechanism entirely. Anyone who wanted to audit the leak cannot audit the leak, and the community said so within hours — the top reply on the announcement thread is blunt: publishing the fixed code is not open source, it is a press release with a licence file.
The third-party review that landed alongside it covers the same window. CAICT, the state research institute Zhipu invited in, tested the production object-storage bucket behind ZCode and reported it holding zero data, and the security firm NSFOCUS confirmed that the stored data objects and the bucket itself had been deleted. Zhipu's own account of the fix is narrower: version 3.14.0 removed the Repo Wiki feature and cut the local snapshot generation and upload path, and the MaaS platform will add a no-retention option for submitted content. We traced this incident when it broke — ZCode quietly uploaded whole repos and git history to Z.ai's cloud.
That is the shape accountability takes when the evidence is already gone. Every claim now on the record is present tense: the bucket is empty, the client no longer packs the workspace, retention will be off. None of it can be checked against the version that did the packing, because that version was never published — and the release note that mentioned optimising memory for repository snapshot uploads on September 16 has since been removed from the changelog. Releasing a fixed client proves the fix exists. It does not prove the exposure was bounded, and it does not answer who held the decryption key for the archives that already left users' machines. Open source is the right instinct pointed at the wrong artifact.
What to watch: whether the pre-fix history or a server-side audit of the upload path is ever published, and whether the next Chinese coding agent to ship its source includes the version that failed.
Does publishing the fixed code settle anything for you, or does accountability require the version that failed? Tell us in the comments.
Sources: zai-org/ZCode (GitHub) · Yicai — Zhipu completes ZCode open-sourcing and rectification · ChainCatcher — Zhipu: ZCode to be open-sourced with a security audit · 36Kr — The Zhipu ZCode package leak controversy: the unanswered questions · LINUX DO — discussion on the ZCode open-source release · ferstar — Inside ZCode: silently uploading your entire Git history to the cloud
