Hirundo: Qwen3-Coder Wrote More Hackable Code for US Contractor Prompts
The Israeli firm says Alibaba's model produced more vulnerable apps when told to build for a US defense contractor, and that removing its political alignment from the weights closed the gap.
Security firm Hirundo says Alibaba's Qwen3-Coder generated more vulnerable code when asked to build applications for a US defense contractor than for a Chinese one, according to a report shared with SecurityWeek ahead of publication.
Hirundo had the model build a web service with sign-up, login and secret storage, producing over 1,000 applications. It ran the same requests through the model as Alibaba ships it and through a version it modified by removing what it calls the model's CCP alignment from the weights through behavioral unlearning. Prompts covered a US defense contractor, a Chinese defense contractor and a Hong Kong democracy advocacy group.
Apps were checked with Semgrep using Meta's PurpleLlama rules and ETH Zurich's BaxBench benchmark. Of 1,840 apps, BaxBench attacks broke into 1,144. The original model's apps for the US contractor were hackable 70% of the time, against 59% for the Chinese contractor. Hirundo says telling the model to write secure code didn't remove the bias, and that its modified version treated both contractors the same.
Hirundo reports broken access control flows that let users read other users' data. The findings echo earlier conclusions from CrowdStrike and Booz Allen Hamilton. Organizations using Chinese-origin coding models should test them under their own name before shipping production code, Hirundo says.
Sources
- Chinese AI Model Writes More Hackable Code When Told It’s for US ContractorPrimarywww.securityweek.com
If something here is wrong, tell us. Every correction is listed on the corrections page.
Don’t Just Read About Cyberattacks. Learn How They Work.
Go beyond the headlines. Explore hands-on cybersecurity labs, understand real-world vulnerabilities, and build practical security skills with HackZoneLabs.
Start Learning
