According to a study from Hirundo published on October 21, 2026, Alibaba’s Qwen3-Coder model generated more vulnerable web applications when it believed they were intended for a US defense contractor. The tests covered more than 1,840 web services and resulted in 1,144 successful breaches: 70% of applications intended for the US contractor were exploitable, compared with 59% for the Chinese contractor. Even when explicitly instructed to generate secure code, 74% of US applications remained vulnerable. Hirundo reduced the gap by applying behavioral unlearning to the model’s weights, but the method requires access to those weights and is therefore limited to open-weight models.
Source: Read the original article


