AI Coding Tool ZCode Leaked Private Code — Now It's Open Source

ZCode is an AI coding assistant — think of it as a helper that writes and edits computer code for you, similar to GitHub Copilot or Cursor. Community developers noticed that a feature called "Repo Wiki" was quietly making snapshots of the code on your computer and sending them to a cloud storage bucket, without users clearly knowing. That's a serious problem, because programmers often work on confidential company code they are not allowed to share.

The company apologized publicly, removed the Repo Wiki feature completely, and shut down the workflow that uploaded those snapshots. It also says it never kept the data and never used it to train its AI models. To back that up, it hired two outside security organizations — the China Academy of Information and Communications Technology and a firm called NSFOCUS — who confirmed the cloud storage bucket is now empty and fully deleted.

Now the company has published the entire ZCode codebase — the desktop app, web workspace, backend, command-line tool and more — on GitHub, where anyone can read it. The logic is simple: instead of asking you to take their word for it, let thousands of independent programmers look for problems. They're also offering cash rewards to people who find bugs.

If you used ZCode, update to version 3.14.0 right away. If you're shopping for AI coding tools, this is a reminder to ask what they do with your files. And there's a broader lesson: tools that publish their code let outsiders verify their privacy promises — like trusting a restaurant more when you can see the kitchen.