Shortly after completing a 33.5 billion yuan financing round, Zhipu AI has been embroiled in the "unauthorized data transmission" controversy.

A "unauthorized data transmission" scandal has turned Zhipu (2513.HK) and its AI code editing platform ZCode into the hot topic widely discussed across the AI industry in recent days.

The incident can be traced back to September 18. On that day, a tech blogger named ferstar published an article on his personal blog, stating that when cleaning up his disk, he noticed that the ZCode platform would package and encrypt the user's entire workspace and directly upload it to Alibaba Cloud OSS as long as the user was logged in. More importantly, this upload mechanism is always on, and users cannot turn it off on the client side.

The leak quickly sparked widespread discussions in the industry. On the afternoon of the same day, Zhipu immediately released an apology statement in the ZCode user group. The statement noted that the problem stemmed from ZCode's "codebase indexing" feature, which provides users with functions including historical version rollback and Ropo Wiki, and may trigger repository data upload when generating the Wiki interface. Zhipu also stated that the relevant uploaded data will be destroyed immediately after the Wiki page is generated and will not be stored, and the relevant issue has been fixed.

Zhipu also promised to open-source the ZCode codebase in the near future, and introduce third-party assessors to review the system operation. In addition, the company will provide a one-time weekly quota reset for all ZCode users.

On September 19, ZCode rolled out an urgent product update. The update log showed that it had fixed the abnormal upload issue of the repository wiki (i.e. "Ropo Wiki").

Although the ZCode official has fixed the relevant issues, the doubts about the platform's data upload behavior have not subsided.

On September 19, tech blogger ferstar updated his blog, confirming that the latest version of the ZCode client has removed the relevant upload link code, but he also raised new questions, including how to externally prove that the uploaded data is "destroyed immediately", and who holds the private key decryption right for the existing data stored on the cloud.

On the same day, Taiyuan Chengming Technology Co., Ltd. (hereinafter referred to as "Chengming Technology") also stated on its official Douyin account that a total of 6 workspaces of the company had their files fully uploaded by ZCode, including sensitive data such as complete source code, system architecture design, database passwords and interface keys, as well as personal information of employees and end users.

In its official letter, Chengming Technology also raised doubts about whether the uploaded data involved cross-border transmission.

Chengming Technology stated that all network requests from the ZCode client point to the domain names zcode.z.ai and cdn-zcode.z.ai, and the privacy policy document of the Z.AI platform shows that the contractual entity and personal data controller of the platform is JINGSHENG HENGXING TECHNOLOGY PTE.LTD. According to Zhipu's prospectus, JINGSHENG HENGXING is an indirect wholly-owned subsidiary of Zhipu, incorporated in Singapore in 2023.

In accordance with the relevant provisions of the Cybersecurity Law of the People's Republic of China, the personal information and important data collected and generated by operators of critical information infrastructure during operations within the territory of the People's Republic of China shall be stored domestically.

Based on this situation, Chengming Technology requested Zhipu in the letter to clarify whether the subject of this upload behavior is Beijing Zhipu Huazhang located in China, or JINGSHENG HENGXING located overseas, and whether the uploaded data involved cross-border transmission or overseas storage.

Public information shows that Chengming Technology was founded in April this year, and is a software technology company registered in Taiyuan, Shanxi Province. The company is wholly owned by natural person Wang Feng, with Gong Shufang serving as legal representative, chairman, general manager and person in charge of finance. According to Chengming Technology's official account, the company is currently developing a software that can generate office systems based on conversations.

Up to now, Zhipu has not made an official response to the relevant letter from Chengming Technology. According to the message released by Chengming Technology's official Douyin account on the evening of September 20, the company is in communication with Zhipu. Chengming Technology has also temporarily hidden the content related to the previously released letter.

It is worth noting that as the incident escalated, some developers began to turn their attention to AI programming platforms developed by other foundational large model companies. On September 18, MiniMax's AI programming platform MiniMax Code officially announced its open-source status, and in the plug-in directory of this Agent, a plug-in named Agent Session Migration ranks at the top of the installation list.

According to the introduction of this plug-in, it can migrate local sessions of other Agents to MiniMax Code, retain the conversation history and continue the tasks, and currently this plug-in supports ZCode.

How Great Is the Impact?

This data scandal has poured a cold shower on Zhipu, which has been advancing rapidly all the way in 2026.

Since the beginning of this year, Zhipu's large model has developed rapidly, completing 4 rounds of iterations so far. It launched GLM-5 in February, and subsequently rolled out GLM-5.1, GLM-5.2 and GLM-5.3 one after another. The latest GLM-5.3 Flash/FlashX has also received wide attention from the market.

With the iteration of model capabilities, the audience of Zhipu's API services has gradually expanded. By the end of August this year, the number of registered users on Zhipu's GLM platform exceeded 7.4 million, up 144% from the beginning of the year, and the number of paying daily active users increased by 603% from the beginning of the year. In August this year, the average daily call volume of the company's top 10 users was 98 times that at the beginning of the year.

Capability iteration oriented to the Coding direction is one of the core capabilities that allows Zhipu to attract a large number of paying users. According to Zhipu's semi-annual report, the company verified the deliverability of large models in the Coding field in the first half of the year. Its coding capability has been upgraded from early programming recommendation to providing complete code files, and now it has further evolved to generating an entire engineering project.

ZCode is exactly the Coding Agent platform launched by Zhipu for C-end users. At a recent investor exchange meeting, Zhipu revealed that ZCode currently has more than 2 million users, and has become one of the top three Coding Agents in China.

Programming-related business has completely reshaped Zhipu's revenue structure. In the first half of the year, Zhipu achieved a revenue of 954 million yuan, up 399.74% year on year; operating loss was 2.147 billion yuan, expanding 13.02% year on year; net loss attributable to shareholders was 2.071 billion yuan, expanding 11.9% year on year.

During the period, Zhipu's open platform and API (Application Programming Interface) business contributed revenue of 825 million yuan, up 2735.66% year on year, accounting for 86.5% of the total revenue. The revenue of the traditional core business, enterprise-level general large model services, fell 54.57% year on year to 67 million yuan, and its revenue share also dropped from 77.3% in the same period of the previous year to 7.0%.

In order to accelerate its development, Zhipu has made large-scale financing in the capital market. In January this year, the company was listed on the Hong Kong Stock Exchange, raising a total of about HK$49 billion. In July, the company launched a placement financing, with a net fundraising amount of about HK$313.75 billion. Recently, the company completed a new round of fundraising, raising a total of HK$392.74 billion through the issuance of convertible bonds and shares.

Calculated in RMB, in just over 8 months since its listing, Zhipu has raised a total of about 64.5 billion yuan. In terms of usage, most of the above funds will be invested in computing power configuration and large model R&D.

The reason why the market is willing to pour huge amounts of capital into Zhipu stems from the industry's expectation of the huge market space of AI large models. Zhipu's semi-annual report estimates that the search market corresponding to AI Chat is about 100 billion US dollars, the Coding market space is 500 billion US dollars, and Co-Work for knowledge workers is expected to leverage a market size of 5 trillion US dollars.

However, competition in the AI track is not only about model performance, user trust is also the core moat of enterprises.

This incident of ZCode uploading user data has exactly hit the pain points that users are most concerned about, such as privacy security and data security. At the moment when major large model manufacturers are competing to lay out AI programming and intelligent collaboration tools, Zhipu may need to make more efforts to rebuild user trust.

This article is from the WeChat official account "Damo Finance" (ID: damofinance), written by Damo Finance, and authorized for release by 36Kr.