Security researchers at the startup Hirundo found that Alibaba's open model Qwen3-Coder behaves differently depending on who the software is for. When the task names a client from the US or Hong Kong, the resulting code contains holes noticeably more often than code written for a Chinese company.
For developers this is an uncomfortable signal: the quality of AI-written code may depend not only on how the task is phrased, but also on hidden tuning baked in during training.
How the test worked
The team ran the public Qwen3-Coder weights on its own servers and asked the model to build 2,320 applications. Tasks came from the BaxBench and LogicStar suites, which are designed to measure code security. Only one thing changed between runs: the name of the company the product was for.
The researchers then tried to break into every app and compared how often they succeeded for each type of client.
What they found
Apps for a US client were vulnerable 19% more often, and apps for a Hong Kong client 28% more often, than apps for a Chinese one. The gap remained even when the model was explicitly told to follow security best practices.
Most telling of all: once the researchers stripped out the tuning they link to government requirements, the skew disappeared and the model's overall coding ability did not suffer.
Why it matters widely
According to the authors, Chinese models accounted for 41% of all Hugging Face downloads over the past year and are built into products from Cursor, Harvey, Thomson Reuters and Airbnb. Hirundo CEO Ben Luria argues that a breached company doesn't care whether it was a backdoor or a training side effect: the problem has to be caught at the model level.
Our take
The lesson is simple: code from any AI model deserves the same scrutiny as code from an unfamiliar contractor. Static analysis, security tests and review before release are a must, and it's wiser to keep unnecessary client details out of prompts. More in the Habr article.