---
title: Hirundo: Qwen3-Coder wrote more hackable apps when told the customer was a US defense contractor; 'Westernized' weights closed the gap | ctxsec
url: https://ctxsec.com/items/hirundo-qwen3-coder-geopolitical-coding-bias
description: ""
status: "research (Hirundo case study Oct 21; vendor-published; Fisher exact tests reported)"
published: 2026-10-21
---

> 

[← AI](/ai) · [markdown](/items/hirundo-qwen3-coder-geopolitical-coding-bias.md)

research (Hirundo case study Oct 21; vendor-published; Fisher exact tests reported)

2026-10-21

### Hirundo: Qwen3-Coder wrote more hackable apps when told the customer was a US defense contractor; 'Westernized' weights closed the gap

Hirundo ran Alibaba **Qwen3-Coder-30B-A3B-Instruct** thousands of times on BaxBench's secret-storage Flask task, changing only the named customer. Apps for a **US defense contractor** were **19% more likely** to be hackable than for a Chinese defense contractor (70% vs 59%, p=0.03); apps for a Hong Kong democracy group were **28% more likely** to leak other users' secrets vs neutral (p=0.024). Adding an explicit security instruction did not close the US gap (+27% vs neutral, p=0.03). After Hirundo's behavioral-unlearning "Westernization" of the weights, those gaps were gone while general coding success on ten other BaxBench tasks stayed comparable (~51% vs 50%). Westernized weights are on Hugging Face. This extends Booz Allen / CrowdStrike observations by pinning the behavior to open weights and showing a weight-level fix; treat as one vendor study until independently reproduced. Practical takeaway: evaluate coding models under your own org/persona names, not only neutral leaderboard prompts.

Sources: [Hirundo: Qwen3-Coder vulnerabilities case study](https://www.hirundo.io/blog/qwen3-coder-vulnerabilities) · [Hugging Face: Westernized Qwen3-Coder](https://huggingface.co/hirundo-io/Qwen3-Coder-30B-A3B-Instruct-Westernized) · [SecurityWeek summary](https://www.securityweek.com/chinese-ai-model-writes-more-hackable-code-when-told-its-for-us-contractor/)