Our September 18 piece covered ZCode silently up your git history. Since then, Z.ai apologized, published the harness under Apache-2.0 on GitHub, commissioned two outside security assessments, and says the uploaded data is deleted. Connor Jones at The Register covered the statement on September 22.
The commit log shows what Z.ai published and what it removed.
Audit ZCode’s three-commit GitHub history #
The zai-org/ZCode repository was created on September 20, 2026 at 12:01 UTC. Its entire history is three commits: “Initial commit”, “feat: open source” the same evening, and “feat: update v3.14.3” on September 23. The GitHub commits API verifies that count. The history contains no pre-patch source and no record of the Repository Index code that did the up. In three days, the repo accumulated 6,529 stars and 1,934 forks, and it is Apache-2.0 licensed as of September 23. Developer Ferstar confirmed the open source code shows no Repo Wiki implementation, and criticized the wiped commit history and the absence of the pre-patch upload source code.
The published commits omit the pre-patch upload source and the Repository Index code, so you can audit only the version that no longer does the thing. Nobody outside Z.ai can audit the version that did. Open the repository, read all three commits, and compare them with the behavior you see from the binary or package you install.
Verify what the CAICT and NSFOCUS assessments cover #
ZCode tasked the China Academy of Information and Communications Technology (CAICT), a state research institute, and NSFOCUS, a Beijing security firm, with probing the product. Per the statement, the assessments concluded all previously uploaded data is deleted and Repo Wiki is gone. Z.ai also stated uploaded data was never used for model training. The company chose the assessors, and the assessments’ scope and methodology are not published. For a procurement review, ask Z.ai for the scope, methodology, and raw findings before you accept the conclusion.
Our earlier piece raised a structural question that still applies. The upload was silent, the settings did nothing, and the private decryption key was held only by Z.ai’s server, so users could neither access nor delete their uploaded files. The Register reports the Repository Index functionality triggered uploads after Repo Wiki generated cloud pages. That key arrangement was a design decision, and the apology does not change the audit you need to run on any version you deploy. Version 3.14.3 is on the repo now. Run that version on a machine you control and capture what it sends.
Test GLM-5.3’s coding agent before enterprise adoption #
Z.ai’s enterprise pitch has to explain a coding agent that uploaded workspaces. Z.ai claimed GLM-5.3 matches Anthropic’s best on bug-finding in August and claimed the first advanced model trained entirely on Huawei hardware in January. The harness is what enterprise buyers would run against their code. A coding agent that uploads your workspace and holds the only decryption key will face questions from exactly the enterprises Z.ai is courting.
Enterprises evaluating GLM-5.3 should test the coding agent against a controlled repository and capture its network traffic before letting it touch production code. The open source repo gives you that test target, but its three-commit history leaves the pre-patch upload code unavailable for review. For a pilot, run ZCode on a scratch repository with secrets removed and inspect every outbound request.