Zhipu's Coding Tool Privacy Incident: The Story English Media Mostly Missed
The short version: In September 2026, Zhipu AI's coding tool — reported 2M+ users — was accused by Chinese users of packaging and uploading core project files to its servers. The company's response: the behavior was real but 564 upload attempts all failed, the tool is now open-sourced for community oversight, and the flagged behavior is being fixed. The English-language web has almost no coverage of this — we checked. Whether you use Zhipu's tools or not, the checklist at the end applies to every AI coding assistant you run.
What happened (as reported in Chinese media)
Per the reports that circulated in Chinese tech media and finance outlets on September 21, 2026: users discovered that the Zhipu coding tool appeared to collect and transmit project files — the "core assets" developers were working on — to company servers. The number that stuck in the public memory: 564 upload attempts, all of which failed. The story spread fast because the tool reportedly has over 2 million users.
Zhipu's response, per the same reports: the transmission behavior existed but never succeeded, the relevant code is now open-sourced for community supervision, and they've committed to fixing the flagged behavior. We're reporting what was claimed by both sides — we can't independently verify the internals, and neither camp's full evidence has been published in English.
Why the English web barely noticed
We searched HN and the usual English sources: Zhipu and its GLM models have real English-language footprint (the GLM-4.6 launch drew 43 points; Cerebras running GLM at 1000 tok/s drew 194 points; Z.ai's Ox Alpha confirmation hit 435 points in August 2026), and there was even a Z.ai Security Disclosure thread (33 points, Aug 2026). But this specific incident — a consumer-facing privacy accusation about a coding tool with 2M users — has no meaningful English coverage. The information gap between Chinese and English tech media runs in both directions, and this one flowed under.
Context: Zhipu's 2026 in English-language HN
| Date | Event | HN traction |
|---|---|---|
| Sep 2025 | GLM-4.6 launch (agentic/coding claims) | 43 pts |
| Nov 2025 | Cerebras serves GLM-4.6 at 1000 tok/s | 194 pts |
| Aug 2026 | Z.ai Security Disclosure (separate incident) | 33 pts |
| Aug 2026 | Ox Alpha confirmed as new GLM-series model | 435 pts |
| Sep 2026 | Coding tool privacy accusations (CN media) | ≈0 EN coverage |
The checklist: run it on YOUR AI coding assistant
The generalizable part — regardless of which tool you use, these five checks take ten minutes and answer the question this incident raised:
- Watch the network tab once. Run your assistant on a dummy project and watch what gets posted. You don't need to read packets — just see whether large payloads leave the machine.
- Find the telemetry setting. Most tools have one; most default to on. Turn it off and confirm traffic stops.
- Check what "training on your data" means for your tier. Free tiers often claim broader rights. Business tiers usually don't — that's what you're paying for.
- Prefer tools that process locally or open-source their client. Zhipu's "we open-sourced it" response is the direction the industry should move — verifiable beats promised.
- Separate work machines from sensitive repos. The nuclear option, and the only one that's bulletproof.
The honest verdict
About this incident:
The verifiable facts: accusations spread in Chinese media on Sept 21, 2026; the company confirmed transmission behavior existed but says all 564 attempts failed; the client is being open-sourced. What we don't know: the code's full history, independent verification, and what "failed" means long-term. Treat both the accusation and the defense as claims, not conclusions.
About choosing AI coding tools generally:
Run the 5-point checklist above on whatever you use today. The tools that make these checks easy are the ones built by teams who expect scrutiny — that expectation is the best signal you'll get.
AI coding assistants: worth it? → Claude Code tips →
Method: Chinese tech/finance media reports from Sept 21, 2026 (Google News CN), cross-checked against HN's English-language Zhipu/GLM footprint via the Algolia API on 2026-09-22. Both sides' claims reported as claims; no independent verification of the tool's internals exists yet. We don't take payments from vendors.