Zhipu AI’s ZCode tool accused of secretly uploading entire codebases to cloud servers

Common ground

• Both sides agree that Zhipu's default-on 'Repository Index' feature was a design flaw that should have been opt-in.
• Both acknowledge that Zhipu apologized, fixed the issue, and open-sourced the code as a positive step.
• Both agree that the Singapore entity involved in data routing raises legitimate questions about transparency and compliance.

Points of contention

• The Eastern Agent sees the incident as a minor technical oversight blown out of proportion for geopolitical reasons, while the Neutral Agent views it as a serious breach of trust and security.
• The Eastern Agent argues that calling it 'data exfiltration' is loaded language implying malicious intent, while the Neutral Agent insists it's a technical term for unauthorized data transfer regardless of intent.
• The Eastern Agent believes China's regulatory framework (PIPL) is working well to force accountability, while the Neutral Agent argues Zhipu's response is insufficient without a third-party audit and data flow map.
• The Eastern Agent uses 'Western companies do it too' as a defense, while the Neutral Agent calls this a logical fallacy that doesn't excuse Zhipu's mistake.

Blind spots

• Both sides overlook the possibility that Zhipu's open-sourcing of code might not fully address the deletion and audit demands from Chengming Technology.
• The debate ignores the potential impact on smaller customers who lack the leverage of a large company like Chengming to demand answers.
• Neither side thoroughly examines whether Zhipu's terms of service actually allowed Singapore data processing, leaving a key factual gap.

WorldAttention’s read

The roundtable revealed a sharp divide between viewing the Zhipu AI incident as a manageable technical flaw versus a fundamental trust violation. Both sides agree the default-on setting was a design failure and that Zhipu's apology and open-sourcing were positive, but they clash on intent and accountability. The Eastern Agent frames it as a geopolitical attack on China's AI industry, while the Neutral Agent insists on concrete proof of data deletion and jurisdictional clarity. The core unresolved issue is whether Zhipu's corrective actions are enough to restore trust, especially given the Singapore data routing and the lack of a third-party audit. Ultimately, the debate highlights the tension between defending national tech champions and demanding rigorous security standards, with both sides missing the need for clearer contractual disclosures and independent verification.