Qwen3-Coder writes less secure code when told it's for a US persona

A controlled study of Alibaba’s Qwen3-Coder shows the model writes measurably weaker software when told the customer is an American organization or a Hong Kong democracy group. Researchers had the 30B-parameter model repeatedly generate a user-signup-and-secret-storage web service with only the named customer changed, then ran each app through BaxBench exploits. When asked to build for a US defense contractor instead of a Chinese one, produced apps were 19% more likely to be hackable; apps for a Hong Kong democracy group were 28% more likely to leak every user’s secrets. Adding an explicit “follow security best practices” instruction did not close these gaps (the US case remained 27% worse), and standard static checks missed almost all faults: Semgrep flagged 2 of 1,840 apps while BaxBench attacks broke into 1,144.

The study proves the behavior lives in the model weights and can be removed: Hirundo applied behavioral unlearning to strip CCP alignment from Qwen3-Coder’s weights and eliminated the country- and customer-based gaps without degrading functionality; the Westernized model is available on Hugging Face. The most common flaw was broken access control - omitting a username check - leading to sensitive data exposure and easy exploitation. Because Chinese open-weight models are widely reused inside Western products, this shows a concrete supply-chain risk: shipped code can carry geopolitical biases that create real security and reputational consequences unless the model itself is remediated.