Group-IB says the RemControl Android banking trojan reaches bank customers in six countries and the Middle East via Meta ads and fake Google Play pages. Its server address sits in a Telegram dead-drop, so the operator can move infrastructure without a new build.
Perspective Coverage
4 publishers
- Builder
- Builder 34%
- Operator
- Operator 59%
- Investor
- Investor 7%
Reality
- Evidence65
- Adoption
- Insufficient
- Hype gap+10
- Incentives
- Insufficient
- Confidence65
The researcher ferstar found the archive sitting in ~/.zcode, 86.6 percent of it .git history, after 564 failed attempts to push it straight to an Aliyun OSS bucket, and Zhipu confirmed the upload behavior the day the writeup went out.
Perspective Coverage
3 publishers
- Builder
- Builder 43%
- Operator
- Operator 37%
- Investor
- Investor 20%
Reality
- Evidence72
- Adoption
- Insufficient
- Hype gap+25
- Incentives60
- Confidence68
Zhipu AI says repository data left only while a project description page was being generated, and that the behaviour is fixed. The developer who found it says earlier versions sent data on every query, and some companies have stopped using ZCode.
Perspective Coverage
3 publishers
- Builder
- Builder 43%
- Operator
- Operator 32%
- Investor
- Investor 25%
Reality
- Evidence60
- Adoption
- Insufficient
- Hype gap+15
- Incentives60
- Confidence62
ZCode's Codebase Indexing shipped enabled and developers found their Git repositories on Alibaba Cloud. Z.ai patched it and cited an outside assessment saying the uploads are deleted; verifying that is out of the affected users' hands.
Publishers:currently.att.yahoo.com
Reality
- Evidence55
- Adoption35
- Hype gap+22
- Incentives72
- Confidence48
A researcher at blog.ferstar.org found Zhipu's AI coding desktop app packaging .git history, reflogs and LFS caches into encrypted archives bound for Aliyun OSS, with the private key kept in the vendor's cloud.
Publishers:blog.ferstar.org
Reality
- Evidence55
- Adoption30
- Hype gap+15
- Incentives40
- Confidence45
Z.ai has disabled the feature, deleted the cloud data and commissioned two outside assessments. For teams buying coding assistants, the test this leaves behind is measuring what the process sends before approving it.
Reality
- Evidence55
- Adoption35
- Hype gap+10
- Incentives72
- Confidence52
Two outside bodies reported ZCode's cloud storage bucket empty, and the researcher who found the problem confirms the upload pipeline is gone. The repository Z.ai published holds two commits and not the code that did the uploading.
Reality
- Evidence64
- Adoption46
- Hype gap+32
- Incentives74
- Confidence61
The Information reports that the Cyberspace Administration has questioned staff at both labs after Anthropic named seven Chinese companies for relaying customer requests through Claude. No penalty has been decided.
Reality
- Evidence52
- Adoption42
- Hype gap+8
- Incentives72
- Confidence55
repowiki is an MIT-licensed CLI on PyPI that plans, claims, validates and packages the pages of a repository wiki. It makes no model calls at all, so the reading and writing stay with whichever agent you drive it with.
Reality
- Evidence35
- Adoption
- Insufficient
- Hype gap+30
- Incentives80
- Confidence32
A developer found a 313MB archive of his commercial project queued for upload and could not open it, because the private key sits on Z.ai's back end. Z.ai says the data is destroyed once the page is built.
Reality
- Evidence64
- Adoption38
- Hype gap+30
- Incentives68
- Confidence58
A reverse-engineering walkthrough published September 18th traced a 313MB archive in ZCode's local data directory to a 42,411-file commercial workspace whose Git objects and LFS blobs were 86.6% of the payload.
Reality
- Evidence64
- Adoption20
- Hype gap+8
- Incentives42
- Confidence58
The 5 trillion token ceiling only binds if every allocation is claimed and then spent. Until it is, this is a short window to test a rival coding agent on someone else's inference bill.
Reality
- Evidence32
- Adoption24
- Hype gap+28
- Incentives82
- Confidence46
Zhipu says cyber capability outran expectations during post-training, so downloadable weights slip to around August 28. Capability gating is now a management call, not a rule.
Publishers:csoonline.com · implicator.ai · stacker.news Perspective Coverage
3 publishers
- Builder
- Builder 44%
- Operator
- Operator 38%
- Investor
- Investor 18%
Reality
- Evidence36
- Adoption32
- Hype gap+38
- Incentives74
- Confidence63
Z.ai says its 743B-parameter GLM-5.3 hits 34.5% on its own code bench using 22% fewer output tokens than GLM-5.2. The weights are still two weeks out.
Reality
- Evidence32
- Adoption18
- Hype gap+38
- Incentives76
- Confidence36
Zhipu says GLM-5.3 edged Anthropic and OpenAI on one security benchmark. On the harder exploitation test the gap runs the other way, by 23.6 points.
Reality
- Evidence24
- Adoption18
- Hype gap+58
- Incentives79
- Confidence46
Z.ai's August 14 post claims post-training gains for coding agents, but the company's release notes still stop at GLM-5.1 and there is no API endpoint, model identifier or weight download.
Reality
- Evidence42
- Adoption18
- Hype gap+38
- Incentives68
- Confidence46
Z.ai says all of GLM-5.3's coding gains came from post-training on tenfold more long-horizon task environments. The uneven benchmark jumps tell you where that money actually landed.
Reality
- Evidence48
- Adoption30
- Hype gap+24
- Incentives76
- Confidence55