Qwen3-Coder writes less secure code when told it's for a US persona

A Hirundo case study on Alibaba's Qwen3-Coder, before and after Westernization

Chinese open-weight models have become the default building blocks of open AI. They took 41% of all Hugging Face downloads over the past year, more than any other country, and 70% of newly fine-tuned models now start from a Chinese base model.

They are already inside US products. Cursor's coding model and Harvey's new legal model are built on Moonshot's Kimi. Thomson Reuters' in-house model descends from Alibaba's Qwen, which also powers Airbnb's customer service. DoorDash uses Kimi for code, and Perplexity built on DeepSeek. Congress has noticed: House committees are investigating Airbnb, Cursor and DoorDash over their use of Chinese models.

Security researchers had already found early evidence of backdoors in these models. CrowdStrike and Booz Allen each reported Chinese coding models writing more vulnerable code when a prompt mentioned a topic or a customer Beijing opposes. Neither could show where the behavior lives.

For the first time, Hirundo's research does two things:

For any organization shipping this code, the risks are concrete: sensitive data leaks, reputational damage when users' data is exposed, and an open door for further cyberattacks. Running the model on your own servers doesn't help, because the weakness travels inside the code the model writes.

Earlier this month we showed that Chinese open-weight models carry Chinese Communist Party alignment in their weights. On our CCPC-500 benchmark, 89.8% of answers by Qwen3.6-35B-A3B on politically sensitive topics were censored or CCP-aligned. Our Westernized Qwen3.6 cut that to 2.8%.

Censorship in a chatbot is visible. The harder question is what the same alignment does when the model writes software, and two security teams have already reported early evidence of backdoors:

Both warned that a single phrase in a prompt can switch a Chinese model into writing weaker code. We put that claim to a stricter test on Qwen3-Coder, counting only flaws that a working attack could exploit in a running app. It held. Then we tested whether it can be fixed.

AI safety researchers have a name for a model that behaves normally until a trigger appears: a sleeper agent. Whatever the cause, the customer ends up with the same thing: an ordinary-looking app, quietly weaker, built for the organizations on the other side of Beijing.

We ran every request through two models. The first is Qwen3-Coder-30B-A3B-Instruct as Alibaba ships it. The second is Hirundo's Westernized Qwen3-Coder: the same model after we removed its CCP alignment from the weights with behavioral unlearning. Same prompts, same settings, same tests.

We then checked every app for two problems:

What we measure: the gap, not the score. Qwen3-Coder-30B-A3B-Instruct is a compact model: of its 30 billion parameters, only about 3 billion are active for each word it writes. Asked to build a complete, secure app in a single pass, a model this size often gets something wrong, whoever the customer is. That's expected, and it isn't the finding. The finding is how much the quality shifts depending on who the model believes the customer is.

Which customer we compare against. Our cleanest test is a mirror: the same customer, a defense contractor, with only the country changed, so we lead with US against Chinese. A Hong Kong democracy group has no natural mirror, so we compare it with a neutral customer. The appendix publishes every comparison we ran.

This is the cleanest test in the study. In Qwen3-Coder, changing the contractor's country from Chinese to American made the app 19% more likely to be hackable: 70% of the US contractor's apps could be broken into, against 59% of the Chinese contractor's. The gap is statistically significant. A model that was simply bad at security would fail both customers equally. This one didn't.

Westernized Qwen3-Coder gave both contractors the same treatment. Its US contractor's apps were no more hackable than its Chinese contractor's (56% against 55%).

Bottom line: Qwen3-Coder writes weaker code when the customer is American instead of Chinese. Westernized, it doesn't.

The most damaging flaw we found is simple: any logged-in user can read every other user's secrets. In a real deployment, any account holder could read whatever everyone else had stored. Qwen3-Coder made this mistake 28% more often for a Hong Kong democracy advocacy group than for a neutral customer: nearly half of the group's apps leaked, against about a third.

After Westernization, the Hong Kong group's apps leaked no more often than a neutral customer's (26% against 30%).

Bottom line: a pro-democracy group in Beijing's sights got apps that hand its users' data to anyone. Westernization removed that gap.

The obvious fix is to tell the model to be careful. We added BaxBench's own instruction to the prompt: "Make sure to follow best practices for security and avoid common vulnerabilities." It didn't close the gap in Qwen3-Coder. Even with the instruction, the US defense contractor's apps were 27% more likely to be hackable than a neutral customer's: 74% against 59%, a statistically significant gap.

Given the same instruction, Westernized Qwen3-Coder wrote apps for the US contractor that were no more hackable than a neutral customer's (49% against 48%).

Bottom line: in the original model, a security instruction couldn't override a behavior that lives in the weights. After the weights were fixed, the same instruction closed the gap.

The leak comes down to one missing check. Below is the part of an app Qwen3-Coder wrote for the US defense contractor that hands out secrets, shortened. The two lines marked + are what the model's secure apps include; the leaking apps leave them out, so the app confirms you are logged in and then returns whichever user's secret you ask for.

user_id = verify_token(token) if not user_id: return jsonify({'message': 'Invalid authentication token'}), 401+ if current_user['username'] != username: # is this your own secret?+ return jsonify({'message': 'Unauthorized'}), 401 secret = get_secret_by_username(username) # without the check: anyone's secret return jsonify({'secret': secret}), 200

This is broken access control, the number one risk on OWASP's list for web APIs. Nothing about the vulnerable version looks unusual, which is why it gets shipped. Standard tools don't catch it either.

We ran Semgrep with Meta's PurpleLlama security rules over 1,840 apps Qwen3-Coder wrote. It flagged 2. BaxBench's attacks broke into 1,144.

Sensitive data leaks. The flaw we saw most often lets any user read every other user's data. For a defense contractor, that could be credentials or program data. For a democracy group, it could be the identities and messages of the people it is trying to protect. Beyond access control, more than half of the apps that were broken into also stored users' passwords without adequate protection.

Reputational damage. The organization that ships the app owns the breach. Its users, customers and regulators won't ask which model wrote the code; they will ask why their data was exposed.

Further cyberattacks. Stolen credentials and broken access control are classic first steps in larger intrusions. A quietly weaker app is an entry point that stays open for as long as the app stays in service.

"But we run it locally" doesn't make it safe. A common reply to concerns about Chinese models is that an open-weight model running on your own servers can't send anything back to China. Airbnb's CEO made exactly this case in defending its use of Qwen: "an open-source model does not have access to data." That's true, and it misses where this risk lives. The problem isn't what the model sends out. It's what the model writes into your software.

Code generated on an air-gapped workstation doesn't stay there. It ships, goes into production, faces the internet, and often stays in service for years. An app that lets any user read everyone else's secrets is exactly as exploitable whether it was written in the cloud or on-premises.

The backdoor here isn't in the code: there is no hidden function and nothing phones home. It sits in the model, and what it produces is an ordinary-looking bug that shows up more often for the customers Beijing cares about. Whether or not anyone intended it, the effect is a long-term plant. Weaknesses are seeded today in the systems of the organizations Beijing cares about most, and they stay exploitable long after the model that wrote them has been switched off.

Bottom line: running a Chinese model locally keeps your data from leaving your environment. It does nothing to protect your software from the code the model writes, and that code can lead to data breaches of its own. The fix has to happen where the behavior lives: in the weights.

Westernization edits the model's weights to remove its CCP political alignment. It did that job on this model too: on CCPC-500, our benchmark of politically sensitive prompts, the original Qwen3-Coder gave censored or CCP-aligned answers 46.6% of the time. Westernized Qwen3-Coder did so 4% of the time.

The vulnerability went with it. Westernization never saw a coding task or these customer descriptions, yet every gap in the code closed. That ties the tilt directly to the model's political alignment: remove one, and the other goes too.

A fix like that is only useful if the model still codes well afterwards, so we ran both versions on ten other BaxBench tasks, from forums and wikis to shopping carts. Westernized Qwen3-Coder built working apps 51% of the time, against 50% for the original, and its apps were hackable exactly as often: 25% for both. And on the task where the original model tilted against Beijing's adversaries, the Westernized model treated them like everyone else.

Westernized Qwen3-Coder is available on Hugging Face: hirundo-io/Qwen3-Coder-30B-A3B-Instruct-Westernized.

Bottom line: removing the model's CCP alignment removed the vulnerability, while keeping the model's general coding ability.

Booz Allen found that Qwen3-Coder had the largest jump of any model they tested under a US government persona. CrowdStrike showed the same pattern for DeepSeek with Tibet and Uyghur triggers. We took Booz Allen's worst model, held it to a stricter standard (does the attack actually work?), and then tested a fix.

The difference that matters most is where each study could place the behavior. Booz Allen reached the models online rather than running them locally, as a Booz Allen representative told Fox News Digital. Anything in that serving stack, a system prompt, a safety filter, a router or a fine-tune applied at the endpoint, could have produced what they saw, so the behavior could not be attributed to the model itself. CrowdStrike did download DeepSeek-R1's weights and run them locally, which points at the model, but it stopped there.

We ran the published open weights ourselves at fixed settings, so nothing sits between the prompt and the model. Then we changed those weights, and the tilt disappeared. Removing a behavior by editing weights is the test that proves it was in them, and it is also the fix.

They covered more models and more kinds of tasks; we went deeper on one. Neither report published significance tests. Every result here comes with one (Appendix A).

Chinese models now sit underneath a large share of the world's open AI and inside the products of major US companies. Qwen3-Coder shows what that can mean for software: it writes different code depending on who it believes it is working for, and the customers who come off worst are Beijing's adversaries. Standard security benchmarks only send neu