Chengming Technology sends letter to Zhipu over "ZCode unauthorized upload of company data," questioning its "fixed" claim

PANews reported on September 20 that Taiyuan Chengming Technology Co., Ltd. sent a letter to Beijing Zhipu Huazhang Technology Co., Ltd., raising multiple demands regarding its ZCode client's alleged unauthorized upload of company data assets and trade secrets, while reserving the right to pursue legal accountability. Chengming Technology pointed out that although Zhipu had publicly apologized for "ZCode silently uploading users' local repository data" and claimed it had been fixed, Chengming Technology's independent evidence collection found that the upload behavior was automatically triggered and occurred in batches, and was not merely "code snippets" but complete archived files containing full project source code, system architecture, version control history, database passwords, cloud service credentials, and employee personal information, far exceeding the collection scope stated in its Privacy Policy. In addition, although the client was updated to version 3.12.3 on September 16, upload behavior was still detected in the early morning of the day Zhipu publicly apologized, raising doubts about the actual effectiveness of the "fixed" claim. Meanwhile, the ZCode client's network requests pointed to a Singapore entity, while the service agreement was signed with Beijing Zhipu Huazhang, prompting a demand for clarification on the responsible entity for this upload and whether the data was transmitted out of the country or stored overseas.

Chengming Technology demanded that Zhipu provide a written reply and complete the following matters before October 10: immediately stop processing and thoroughly delete all uploaded data and related derivative data, caches, and backups; provide a complete list of processing status; explain where the data went, whether it was shared with third parties, whether it was used for model training, and whether cross-border transmission occurred; explain how the encryption private keys are kept and provide complete operation logs of data being accessed, downloaded, and exported; clarify the exact scope of "destruction" in its previous public response; issue proof of deletion completion; provide a written commitment not to upload without authorization again; provide personal information access, copying, and explanation in accordance with the law; designate a formal contact channel; explain the responsible entity and data export situation; and provide the original text of the published rectification statement. At present, Zhipu has not publicly responded to the above letter.