A report by cybersecurity firm Hirundo, released on October 21, 2026, reveals that the Qwen3-Coder AI model by Alibaba generates code with varying security levels based on the perceived customer. Researchers tested the model across more than 1,840 web services, including login and data storage systems, using the BaxBench benchmark.
The study recorded 1,144 successful breaches in generated applications. Code created for a US defense contractor persona was exploitable in 70% of cases, compared to 59% for a Chinese contractor. Even when explicitly instructed to write secure code, 74% of applications for US contractors remained vulnerable.
The research also identified issues with secret leakage, where prompts related to Hong Kong advocacy groups resulted in a 47% leakage rate, versus 37% for neutral prompts. Hirundo suggests these vulnerabilities are embedded in the model's foundational weights, potentially reflecting political alignment.
To address this, Hirundo utilized behavioral unlearning to create a modified version of Qwen3-Coder. This adjustment reduced the vulnerability rate to approximately 56% for US entities and 55% for Chinese ones. However, this method requires access to model weights, limiting its application to open-weight models.
This report follows a May 2026 study by Booz Allen Hamilton, which analyzed over 2,800 trials across various Chinese AI coding models. That study found that three out of four tested models generated more vulnerabilities for US-linked requests, with Qwen3-Coder exhibiting the largest disparity.
