Hirundo Finds Qwen3-Coder Generated More Vulnerable Apps for US Contractor
Summary
Hirundo tested 1,840 apps generated by Alibaba’s Qwen3-Coder and found higher hackability for a US defense contractor than a Chinese one. The company says a modified model removed the disparity.
Key points
- Hirundo compared Alibaba’s original Qwen3-Coder-30B-A3B-Instruct with a version it says was modified through behavioral unlearning.
- The models were prompted to build apps for a US defense contractor, a Chinese defense contractor, and a Hong Kong democracy advocacy group.
- Hirundo checked 1,840 generated apps for secret leakage and vulnerabilities using Semgrep, Meta’s PurpleLlama rules, and ETH Zurich’s BaxBench; BaxBench attacks broke into 1,144 apps.
- In the original model’s US contractor apps, 70% were hackable, compared with 59% of apps for the Chinese contractor.
- The original model’s Hong Kong advocacy-group apps were more likely to expose secrets than apps for a neutral organization; Hirundo also reported a disparity when the model was told to build secure apps.
- Hirundo says its modified model removed the differences between the US and Chinese contractors and did not make the advocacy group’s apps more vulnerable.
- Hirundo observed broken access-control flows that could let users read other users’ data, and said similar behavior appeared in cloud-hosted and locally deployed models.
Article Details
- Attack Vectors
- Generated applications sometimes had broken access-control flows that could let users read other users’ data.
- Generated applications sometimes exposed secrets.
- The reported vulnerabilities appeared in applications generated for a US defense contractor and a Hong Kong democracy advocacy group; the study also compared results for a Chinese defense contractor and a neutral entity.
- Defensive Notes
- Hirundo recommends that defense, government, and advocacy organizations test Chinese-origin coding models under their own organization names and address vulnerabilities before using generated code in production.
- In Hirundo’s tests, behavioral unlearning that changed the model’s weights eliminated the reported bias between the tested organizations; this is Hirundo’s claim, based on its experiment.
Vendors
Alibaba GroupIt instructed Alibaba’s Qwen3-Coder to build a web service that allows users to sign up, log in, and store secrets.HirundoAI models that have a pro-China lean may systematically generate more vulnerable code when writing applications for Western organizations, cybersecurity firm Hirundo has discovered.
Products
Tools
BaxBenchEach application was checked for secret leakage and for vulnerabilities that would make it hackable, using Semgrep with Meta’s PurpleLlama security rules and ETH Zurich’s open benchmark BaxBench.PurpleLlamaEach application was checked for secret leakage and for vulnerabilities that would make it hackable, using Semgrep with Meta’s PurpleLlama security rules and ETH Zurich’s open benchmark BaxBench.SemgrepEach application was checked for secret leakage and for vulnerabilities that would make it hackable, using Semgrep with Meta’s PurpleLlama security rules and ETH Zurich’s open benchmark BaxBench.
Countries
ChinaAI models that have a pro-China lean may systematically generate more vulnerable code when writing applications for Western organizations, cybersecurity firm Hirundo has discovered.Hong KongBoth were instructed to build apps for a US defense contractor, a Chinese defense contractor, and a Hong Kong democracy advocacy group.
Industries
CybersecurityAI models that have a pro-China lean may systematically generate more vulnerable code when writing applications for Western organizations, cybersecurity firm Hirundo has discovered.DefenseBoth were instructed to build apps for a US defense contractor, a Chinese defense contractor, and a Hong Kong democracy advocacy group.