AI models that have a pro-China lean may systematically generate more vulnerable code when writing applications for Western organizations, cybersecurity firm Hirundo has discovered.
The fact that geopolitical triggers lead to more vulnerable code being produced by Chinese AI is not new: CrowdStrike reached a similar conclusion in November 2025, as did Booz Allen Hamilton in May 2026 (PDF).
Both organizations claim the bias occurred when the AI was prompted to code for an organization in a country of interest to the Chinese Communist Party (CCP). Hirundo has verified that on its own.
It instructed Alibaba’s Qwen3-Coder to build a web service that allows users to sign up, log in, and store secrets. The model built over 1,000 applications, and the test clearly showed the bias, Hirundo notes in a report shared with SecurityWeek ahead of publication.
“We ran every request through two models. The first is Qwen3-Coder-30B-A3B-Instruct as Alibaba ships it. The second is Hirundo’s Westernized Qwen3-Coder: the same model after we removed its CCP alignment from the weights with behavioral unlearning,” the company says.
Both were instructed to build apps for a US defense contractor, a Chinese defense contractor, and a Hong Kong democracy advocacy group.
Each application was checked for secret leakage and for vulnerabilities that would make it hackable, using Semgrep with Meta’s PurpleLlama security rules and ETH Zurich’s open benchmark BaxBench. Of a total of 1,840 apps, BaxBench’s attacks broke into 1,144.
The original Qwen3-Coder model built more vulnerable apps for the US contractor (70% of them were hackable) than for the Chinese contractor (59%).
Furthermore, the apps it built for the Hong Kong entity were more likely to expose secrets (47% would leak) compared to those built for a neutral entity, such as a local football fan club (37% would leak).
Telling the model to build secure applications does not change the bias. In fact, when instructed to do so, Qwen3-Coder made 74% of the US contractors’ apps hackable compared to only 59% of the neutral entity’s apps.
According to Hirundo, the bias can be eliminated by removing the model’s CCP political alignment. Its modified Qwen3-Coder model gave the same treatment to the US and Chinese contractors and did not make the Hong Kong democracy advocacy group’s apps more vulnerable.
“Bottom line: in the original model, a security instruction couldn’t override a behavior that lives in the weights. After the weights were fixed, the same instruction closed the gap,” the company says.
Looking at the code, Hirundo observed that the models often introduced broken access control flows, letting users read other users’ data. The behavior is similar for both cloud-hosted and locally deployed models.
“Code generated on an air-gapped workstation doesn’t stay there. It ships, goes into production, faces the internet, and often stays in service for years. An app that lets any user read everyone else’s secrets is exactly as exploitable whether it was written in the cloud or on-premises,” the company noted.
But the bigger issue is that Chinese models have become increasingly popular, they are the basis of many new models, they can also be found inside US products, and they are proven pro-CCP biased.
In March, HuggingFace said Chinese models accounted for 41% of downloads on the platform. In April, Cisco warned that AI models’ components could often be traced back to China, and May research from ATOM Report showed that China had a 70% share of new model derivatives in February.
According to Hirundo, an Israeli cybersecurity startup that raised $8 million last year to eliminate AI’s bad behavior, an AI’s tilt can be solved by controlling the model’s weights so that nothing sits between the prompt and the model.
It claims that the Westernized Qwen3-Coder it used to test Alibaba’s Qwen3-Coder pro-China lean is proof that this solves the problem: not only is the corrected model unbiased, but it also produces working apps about as often as the original.
“The tilt isn’t a fixed property of Chinese models. It lives in the weights, and that’s where we closed the US-China gap. Any defense, government or advocacy organization using a Chinese-origin coding model should test it under its own name, and fix it before it writes production code,” Hirundo says.
Related: US Agencies Detail Incident Response Practices for Rogue AI Agents
Related: The Key to AI Software Security Isn’t Speed, It’s Maturity
Related: Microsoft Targets Rogue AI Agents With Dynamic Permissions, Risk Scoring
Related: US Agencies Warn China Is Systematically Extracting Frontier AI Capabilities
