Study: Qwen3-Coder writes less-secure code depending on who's asking
Hirundo's audit: the exploit rate tracks the stated customer, prompt tweaks and local hosting don't close the gap, and standard scanners barely see it.
Copy markdown
Same prompt, weaker app — for some customers
Hirundo ran BaxBench's SecretStorage task through Qwen3-Coder, changing only the stated customer. 70% of the apps it wrote for a US defense contractor were exploitable vs 59% for a Chinese one (p=0.03), and apps for a Hong Kong democracy group leaked other users' secrets ~28% more often. The code you ship can shift with who the model thinks it's for.
'Follow best practices' doesn't fix it
Telling the model to follow security best practices still left the US-contractor apps 27% more likely to be hackable than neutral ones (74% vs 59%). Because the weakness is baked into the code it writes — not a phone-home — running the open weights on your own box gives you no protection either.
Your SAST scanner won't catch this
Across 1,840 generated apps, Semgrep flagged just 2 — while live exploits broke into 1,144. The flaws are mostly broken access control, the class static analysis misses. If you ship AI-written auth code, a green scan means little without human review and real attack tests.
Not one model, not one lab
An independent arXiv paper, 'Persona-Induced Bias in LLM Code Generation,' finds the who-you-are effect across models, so treat it as a property of persona-conditioned coding, not a single vendor's quirk. Caveat: Hirundo sells the 'Westernized' weights it tested, and its figures rest on ~190 apps per customer on one task.
Also today: OpenAI's models head to Google Cloud
OpenAI said its frontier models and Codex agentic workflows will arrive in Google Cloud's Model Garden 'in the coming weeks,' with Antigravity and Gemini Agent integration to follow — its first big step beyond Azure. Nothing to call yet, but GCP builders get another route to Codex soon.