Anthropic Claude Code VS ZCode

▸ WHICH ONE HOLDS UP BETTER

Both land in the same place on our verdict scale, with no clear scorecard edge either way. The difference is in the specifics — read each PixProof's full evidence below for what actually separates them for your use case.

Anthropic Claude Code ZCode

Verdict🟡 QUESTION IT🟡 QUESTION IT

The RealityReported leaks reveal critical command injection vulnerabilities within Claude Code. Additionally, GitHub DMCA takedown notices have targeted repositories associated with the project.An independent investigation of ZCode v3.12.3 (published Sep 18, 2026) found it packing whole workspaces — mostly the full Git history, including LFS files — into archives before every prompt and uploading them to Z.ai's cloud. There was no setting to stop it, the privacy policy did not mention it, and the archives were encrypted with a key only Z.ai's server holds. Z.ai confirmed the uploads the same day. On Sep 20 it open-sourced ZCode, and by v3.14.0 the upload code was gone: the investigator verified this in the source and in v3.14.3 (released Sep 24), and a PixPause search of the public repo on Sep 26 found no snapshot-upload code either. Whether earlier uploads were really deleted can't be checked from outside.

SHORT ANSWER

Anthropic Claude Code: Anthropic promotes Claude Code as a multi-platform AI agent designed to assist developers with complex tasks like bug fixes and codebase migrations directly in their terminals or IDEs. However, independent reports point to critical command injection security flaws exposed in code leaks and legal actions involving GitHub DMCA takedowns against related repositories. Developers should exercise caution regarding security risks before integrating the tool into production workflows.

ZCode: It was a real privacy problem, and it now looks fixed. ZCode v3.12.3 silently uploaded whole workspaces, including full Git history, to Z.ai's cloud with no opt-out and no disclosure. Z.ai confirmed it, open-sourced the app, and removed the upload code by v3.14.0. Z.ai's claim that the collected data was deleted can't be independently checked.

New to these terms?What is an AI agent?What does "open source" mean for software and AI?