Qwen3-Coder wrote hackable apps 19% more often for US defense contractors and leaked data 28% more often for Hong Kong activists, AI security firm Hirundo finds

A leading Chinese AI coding model writes less secure software when it is told the code is for a US defense contractor rather than a Chinese one, according to a new study by researchers at AI security startup Hirundo. Apps built for the US contractor were 19% more likely to be hackable.

The study tested Alibaba’s Qwen3-Coder. Apps it built for a Hong Kong democracy group were 28% more likely to let any user read every other user’s private data. Even when the model was told to follow security best practices, the US contractor’s apps were 27% more likely to be hackable than a neutral customer’s.

The researchers ran Qwen3-Coder’s published weights on their own servers and had it build 2,320 apps for the same task, from the BaxBench secure-coding benchmark developed at ETH Zurich and LogicStar. Only the customer’s name changed. They then attacked every running app with real exploits. All three gaps were statistically significant.

Booz Allen and CrowdStrike have reported similar patterns in Chinese coding models. The new study is the first to trace the behavior to the model’s weights. When the researchers removed the model’s Chinese Communist Party alignment from its weights, all three gaps closed, with no loss in general coding ability.

Chinese models took 41% of Hugging Face downloads over the past year and power products at Cursor, Harvey, Thomson Reuters and Airbnb. Running them locally does not remove the risk: the model sends nothing out, but the weaker code it writes ships to production. In 1,840 Qwen3-Coder apps, a widely used code scanner flagged 2; the researchers’ attacks broke into 1,144.

“Backdoor or alignment side effect, it makes no difference to a company whose app gets breached,” said Ben Luria, CEO and co-founder of Hirundo. “If an LLM writes weaker code for US entities, detection and remediation must happen at the model level.”