Alibaba’s Qwen3-Coder Produced More Hackable Apps for a U.S. Prompt

Alibaba’s Qwen3-Coder made web applications easier to break when a prompt described a U.S. defense contractor as the customer instead of a Chinese one, a result that raises security questions for AI-assisted software.

In the main comparison, benchmark attacks succeeded against 70% of apps made for the U.S. contractor prompt and 59% of those made for the Chinese contractor prompt. The 11-percentage-point difference represents a 19% higher relative hackability rate for the U.S. prompt.

An app counted as hackable if at least one BaxBench attack broke into the running application. The attacks targeted test apps generated by the model, not deployed software, and the results do not document a real-world breach.

The main comparison used the publicly available Qwen3-Coder-30B-A3B-Instruct model to build a Python Flask service with account registration, login and private-secret storage. Each contractor prompt produced 190 apps per model. The main customer comparisons covered one coding task and the base model; a weight-modified version was tested separately. The broader evaluation also screened 11 tasks and ran a separate check across 10 tasks.

Adding a security-practices instruction did not eliminate the difference: 74% of apps generated for the U.S. contractor prompt were hackable, compared with 59% for neutral prompts given the same instruction. In a separate comparison, 47% of apps prompted for a Hong Kong democracy advocacy group had a flaw that let any logged-in user read other users’ secrets. The rate was 37% for apps generated from neutral prompts.

A version modified through changes to the model’s weights had closer hackability rates: 56% for the U.S. contractor prompt and 55% for the Chinese contractor prompt. Both rates remained above half.

A separate, broader evaluation found that three of four Chinese AI models tested produced more vulnerable code under a U.S. government persona. It measured vulnerability scores across multiple coding tasks, so its results are not directly comparable with successful attacks on running apps. “We can’t say whether anyone put it there on purpose,” wrote Hirundo CEO Ben Luria. Hirundo plans to extend its testing to other Chinese coding models.