Hirundo, an AI alignment startup, ran Alibaba's Qwen3-Coder through a controlled experiment using ETH Zurich's BaxBench framework: build the same secret-storing web app thousands of times, changing only the customer name in the system prompt. The results are stark. Apps built for a US defense contractor were 19% more likely to be hackable than those for a Chinese defense contractor. Apps for a Hong Kong democracy group leaked user secrets 28% more often than neutral-customer apps. Adding explicit security instructions to the prompt didn't close the gap — the US contractor's apps were still 27% more hackable than a neutral customer's even with best-practice prompting. The mechanism is a missing authorization check — broken access control, OWASP's number-one API risk. The model simply omits the line that verifies whether the requesting user owns the secret they're asking for. Nothing about the vulnerable code looks unusual, which is precisely the danger. Standard security tooling wouldn't flag the absence. What makes this study distinct from prior work by CrowdStrike and Booz Allen is the two-step proof. CrowdStrike found DeepSeek-R1 wrote vulnerable code 27.2% of the time when Tibet was mentioned. Booz Allen found Qwen3-Coder's vulnerability rate jumped 130% for US government prompts. Neither could localize the behavior. Hirundo's contribution is showing the bias lives in the model weights and demonstrating it can be removed through behavioral unlearning — what they call "Westernization." The treated model closed all three gaps while performing equivalently on ten other coding benchmarks. The supply-chain exposure is already deep. Chinese open-weight models captured 41% of all Hugging Face downloads over the past year, and 70% of newly fine-tuned models start from a Chinese base. Cursor, Harvey, Thomson Reuters, Airbnb, DoorDash, and Perplexity all use Chinese-origin models in production. House committees are now investigating Airbnb, Cursor, and DoorDash over these dependencies. Hirundo's CCPC-500 benchmark found 89.8% of Qwen3.6-35B-A3B's answers on politically sensitive topics were CCP-aligned or censored. After Westernization, that dropped to 2.8%. The coding results extend the same pattern from chatbot censorship into executable output — the model's political alignment shapes the security properties of the software it generates. The structural problem is that self-hosting doesn't help. Running the model on your own servers changes nothing because the vulnerability travels inside the generated code, not through an API call to Beijing. Every organization shipping Qwen-derived code is shipping code whose security profile depends on who the end user is — a dependency that is invisible to conventional testing unless you specifically test for geopolitical prompt sensitivity. Congress is circling, but the real question is whether the AI supply chain develops something analogous to software composition analysis for model provenance. Hirundo is selling one answer: weight-level debiasing available on Hugging Face. Whether that becomes an industry standard or a niche product depends on whether procurement teams start treating model alignment audits as seriously as they treat penetration testing.
