Ben Luria reports a Hirundo experiment in which Qwen3-Coder builds the same private-secret storage app for different named customers. The company tests running applications with working attacks, then repeats the experiment after modifying the model’s weights, its learned numerical parameters.

  • The original model produced hackable apps in 70% of US-contractor cases versus 59% of Chinese-contractor cases. The advertised 19% increase is relative, rather than a 19-percentage-point gap.
  • Asking it to follow security best practices left a gap: 74% hackable for the US persona versus 59% for neutral customers.
  • Hirundo’s modified model narrowed those comparisons to 56% versus 55%, and 49% versus 48%. Those remain high absolute failure rates.

Hirundo first screened eleven coding tasks, then expanded the secret-storage experiment. It sells the model-remediation process being tested. These are vendor-reported findings on one model and a selected task; the article acknowledges that it cannot establish deliberate implantation.

Testing the customer context in an actual agent prompt is worth doing. So is checking whether one account can read another account’s secrets, even when registration and login work.

The 115-comment thread on Hacker News adds competing evidence and questions about the scope of the result.

What the thread adds

  • alexcpn — reports a different experiment: “Across 6,237 working programs, exactly ten failed a security check.” They report no systematic customer or country pattern. This is a commenter’s self-report with different tests, not a verified replication.
  • lukewarm707, tedivm and nneonneo — three commenters question relevance to newer models. nneonneo asks for evidence “with later models and with models that are more secure-by-default.”
  • jebarker — pushes back on dismissing older-model research: “it doesn’t mean there’s no value in studying older models. Unless you think we understand all the behaviors of those older models.”

An unanswered implementation question

jrmg asks how the claimed removal of political alignment works: “That’s a very definitive statement. How?” Roark66 also asks for the data and scripts. A reproducible intervention would make the causal claim easier to test.

Handles are pseudonymous; HN publishes no per-comment scores. This is a slice of the thread in HN’s own ranking order, not a consensus.