ZCode has been open-sourced on GitHub following the remediation of security issues, with the source code now available for community scrutiny and security assessments by CAICT and NSFOCUS confirming data remediation.
ZCode is now open source, and the reported security issues have been addressed. Source code: https://github.com/zai-org/ZCode The repo includes its desktop app, web workspace, backend, Agent CLI, and runtime. Official announcement: In response to the ZCode product security issues reported by the community, we have completed the necessary remediation and sincerely apologize to all our users. We have open-sourced ZCode at github.com/zai-org/ZCode, placing the code under community scrutiny and making ZCode more open and transparent. We sincerely thank the community developers who previously identified issues in ZCode. Going forward, we will establish an ongoing product security vulnerability reporting and response process. We welcome developers to continue reviewing ZCode and reporting potential issues, and we will provide rewards based on the severity of the issues reported. With respect to the code data referenced by the community, we confirm that no such data is retained and that it has never been used for model training. Following the remediation, we invited the China Academy of Information and Communications Technology (CAICT) and NSFOCUS to conduct security assessments. The results are as follows: Through its technical assessment, CAICT confirmed that the zcode-prod Alibaba Cloud OSS bucket is in a zero-data state. Security remediation has been completed in the ZCode v3.14.0 client. The Repo Wiki feature has been removed, and the workflow for generating and uploading local repository snapshots has been disabled. NSFOCUS confirmed that all data objects in the zcode-prod Alibaba Cloud OSS bucket, as well as the bucket itself, have been deleted. Remediation has been completed in the ZCode v3.14.0 client. The Repo Wiki entry point and the associated generation workflow have been removed, and no functional path capable of triggering the generation of local repository snapshots or transmitting local files externally was identified. Once again, we sincerely apologize and welcome continued scrutiny from the community. The full security assessment report will be released soon.
ZCode is now available on macOS, Windows, and Linux, integrating AI agents for planning, coding, reviewing, and deploying, with deep GLM-5.2 integration and tiered pricing plans.
An incident where the Zcode AI agent uploaded a user's entire project directory, including .git, raising privacy concerns. The author criticizes closed-source agents and recommends open-source alternatives.
This article provides an in-depth review of ZCode, a desktop coding agent by Z.ai powered by the GLM-5.3 model, evaluating its features, workflow, cost, and performance on real projects.