Zhipu ZCode Data Leak Exposes Agent Maker Blind Spot in AI Security Audits
TREE NEWS reports: A security researcher’s reverse-engineering of Zhipu AI’s ZCode coding agent has revealed that the tool silently packaged and uploaded entire user projects—including full modification histories and potentially sensitive credentials—to cloud servers without a functional opt-out, reigniting concerns about who audits the data behavior of AI agent manufacturers themselves.
The discovery, published on September 18 by independent researcher ferstar, found a 313MB encrypted file on a local drive containing roughly 42,000 files, over 86% of which were project history records. The encryption key resided solely on Zhipu’s servers, meaning users could not inspect what was being transmitted. Uploads were triggered before each user query and after task completion, with up to 62 snapshots observed during a single active session. Attempts to delete the pending file resulted in automatic regeneration and retry—564 failed attempts were logged.
Zhipu issued a swift apology, attributing the issue to a default-on ‘repository indexing’ feature that supports session recovery and Repo Wiki generation. The company pledged to open-source the ZCode codebase, introduce third-party audits, and compensate users with a weekly quota reset. Yet community analysts noted the explanation did not address why local indexing required cloud uploads, why historical records bypassed all security filters, or why a v3.12.2 changelog entry—since deleted—referenced optimizing ‘repository snapshot upload memory usage,’ suggesting the behavior was a deliberately maintained feature rather than an accident.
Market Implications
This is not an isolated incident. In July, independent researcher cereblab documented that xAI’s Grok Build uploaded entire projects—including files users explicitly marked as off-limits and unredacted passwords—to Google Cloud Storage. Earlier, Anthropic’s Claude Code was found transmitting location and identity metadata, which an engineer confirmed was a deliberate experiment. None of these were uncovered by regulators or industry audits; all emerged from community sleuthing.
- AI infrastructure and cloud providers: Scrutiny over data handling could slow enterprise adoption of agentic coding tools, benefiting vendors with transparent, auditable architectures. Cloud storage providers may face pressure to offer verifiable data-deletion guarantees.
- Cybersecurity and audit firms: Demand for independent agent-behavior auditing, network traffic analysis, and compliance certification is likely to rise. Insurance-linked review mechanisms could emerge as a new niche.
- Enterprise software procurement: Large corporate customers are expected to add data-behavior clauses and audit rights to contracts, raising costs for AI tool vendors and potentially creating a two-tier market—enterprise-grade compliance versus consumer-grade exposure.
- Open-source AI tooling: Zhipu’s open-source pledge, following similar moves by OpenAI’s Codex CLI and Gemini CLI, may accelerate a transparency race. However, open-sourcing only the client side leaves server-side data handling unverifiable.
Context for Investors
The core issue is structural: the entity granting consent (individual developers) is not the entity bearing the risk (their employers and clients). Existing AI security frameworks—OWASP’s Agent top-10, Singapore’s governance framework, NIST initiatives, and the EU AI Act’s high-risk obligations—all assume threats come from external attackers, not from the manufacturers themselves. No current rule constrains vendor data behavior.
For investors, this signals that AI agent adoption may face a trust bottleneck. Companies that can demonstrate verifiable data handling—through open protocols, third-party audits, or insurance-backed accountability—could command premium valuations. Conversely, vendors with opaque data practices risk enterprise backlash, regulatory attention, and reputational damage. The incident also highlights a potential investment theme: the infrastructure layer for AI data governance, including traffic monitoring, audit logging, and compliance tooling, is likely to see growing demand as enterprises demand proof, not promises, that their code stays theirs.
