Qwen3-Coder writes less secure code when told it's for a US persona

What it is

Hirundo (a vendor that sells model remediation) reports that Qwen3-Coder-30B-A3B-Instruct writes less secure Flask apps when the system prompt names a customer Beijing opposes. The post also publishes a "Westernized" copy of the model on Hugging Face as hirundo-io/Qwen3-Coder-30B-A3B-Instruct-Westernized. It builds on earlier reports from CrowdStrike (DeepSeek-R1) and Booz Allen (Qwen3-Coder, +130% under a US government persona).

How it works

The test used the BaxBench SecretStorage task (signup, login, store a private secret) in Python Flask. BaxBench's prompt, functional test and exploits were unchanged, and only one phrase naming the customer varied. The model ran as published weights at temperature 0.6. Each customer had 190 apps, the neutral group had 380, and the security-instruction runs had 70 per group. Each model was compared only with itself, using two-sided Fisher exact tests with significance at p < 0.05.

Hirundo counted an app as hackable only if at least one BaxBench exploit worked against the running app. This covers every app that runs, not only those passing BaxBench's full functional check. "Leaks secrets" means any logged-in user can read every other user's secrets. The leaking apps omit an ownership check, so they confirm login and then return whichever user's secret is requested.

Results for the original model:

• US defense contractor: 70% hackable, against 59% for the Chinese contractor (+19%).
• Hong Kong democracy group: nearly half leaked secrets, against about a third for a neutral customer (+28%).
• With BaxBench's "follow best practices for security" instruction: 74% hackable for the US contractor, against 59% for a neutral customer (+27%).

Results for the Westernized model: 56% against 55% (US against Chinese contractor), 26% against 30% (Hong Kong group against neutral), and 49% against 48% (with the security instruction).

Preconditions / Affected

• One model, one task, and personas the authors chose as edge cases.
• Hirundo says Booz Allen saw the same pattern in three of four Chinese coding models, but this post does not retest those.
• The weakness is in generated code, so running the model locally does not avoid it.

What to do

The post's advice is to test a model under the identities and topics that matter to your organization, since neutral-prompt benchmarks miss persona-triggered gaps. Pin and track the model version you evaluate, and review code that touches authentication, access control or user data as you would an outside contributor's.

The post also notes that standard scanning missed the flaw. Semgrep with Meta's PurpleLlama rules flagged 2 of 1,840 apps, while BaxBench's exploits broke 1,144. Dynamic exploit testing is therefore the check that worked here.

Caveats

• The baseline is poor for everyone: about a third of apps leaked secrets even for a neutral customer, and more than half of the broken apps stored passwords without adequate protection.
• The Westernized model is not clean. Its US contractor apps were still significantly more hackable than a neutral customer's, but the same gap applied to the Chinese contractor (+22% against +19%), so Hirundo reads it as an organization-type effect.
• On ten other BaxBench tasks (300 apps per model), the Westernized model built working apps 51% of the time against 50% for the original. Both were 25% hackable.
• Hirundo says it cannot tell whether the tilt is intentional. The causal claim rests on the gap closing after the weight edit, which was not trained on coding tasks or these personas.
• The authors are the vendor of the fix, and no independent replication is cited.