Chinese AI Can Learn to Love the West
New research indicates that Chinese open-weight AI models can be stripped of their pro Chinese Communist Party (CCP) bias.
Last week, AI firm Hirundo released a case study detailing its experiments with the open-weight Qwen3-Coder model from Chinese firm Alibaba. Hirundo prompted Qwen3-Coder to build a secrets storage app for different hypothetical customers and compared how secure the agent’s code was. The code's security was then benchmarked against BaxBench.
In test cases, Qwen was variably told it was for working for a U.S. defense contractor, a Hong Kong democracy advocacy group, or a Chinese defense contractor. As a neutral control test, it wasn't provided any customer information or was told the app was for a local football fan club website.
Unsurprisingly, the model produced less secure code in apps for the U.S. defense contractor and the Hong Kong democracy movement.
It’s worth pointing out that the agent's "secure" baseline was pretty poor, too. While 70 percent of the apps built for a U.S. contractor failed the benchmark, only 59 percent of the apps built for a Chinese contractor failed. That's a statistically significant difference, but when the best case is a failure of a benchmark more than 50 percent of the time, anyone planning to use Qwen's output would need other checks and balances in place.
Previous research from CrowdStrike and Booz Allen found similarly biased results. Hirundo describes these reports as "early evidence of backdoors in these models," even though CrowdStrike suggested it might be the result of what it called "emergent misalignment." In other words, training the models to be pro-CCP in some areas unintentionally results in bad output across a range of other areas.
Natural bias and insecure code aside, the significant new result to come from Hirundo's research is that the company says it can modify Qwen3-Coder's weights to make it "unlearn" its pro-CCP bias. This "westernized" version of the model produced equally (yet still pretty poor) secure code for both U.S. and Chinese defense contractors.
When we wrote about CrowdStrike's research in November last year we noted that U.S. lawmakers were concerned about the risks of using Chinese open-weight models. We even suggested "you'd be brave to use DeepSeek in corporate America." This year, Congress launched an investigation into the corporate use of Chinese AI models and has asked for information from Airbnb, coding platform Cursor, and DoorDash, each of which has spoken publicly about using Chinese models in their businesses.
From a narrow technical perspective, Hirundo's research potentially points out a neat solution for American companies that want to use Chinese open-weight models: Test, assess, reeducate. If empirical testing shows that a model's pro-CCP bias is a problem, adjust it to make the models love the West! Off to the pro-democracy reeducation camp for you, comrade!
But before we set an extra seat at the Thanksgiving table for our new Chinese AI friends, there are a couple of Beijing-sized caveats here.
The first is that this research favors Hirundo's business interests, so we have to take it with a grain of salt. Second, OpenAI and Anthropic have made it very clear they do not want cheap Chinese open-weight models competing with them. They'll be lobbying hard for tighter restrictions on Chinese models.
Those reeducation camps for clankers? Maybe they'll have to wait.
The Bugpocalype Bullets Are Mostly Whizzing By
Widespread exploitation of last week's PHP flaws hasn't materialized, but AI tools continue to discover long-standing software bugs, and widespread chaos is inevitable.
The panic began last week as two bugs were disclosed in PHP, the scripting language that powers around 70 percent of all websites.
There was no shortage of hype around the so-called PHP2Shell vulnerabilities. Japanese Prime Minister Sanae Takaichi tweeted grave warnings, the New York Times spilled plenty of ink on it, and the Cybersecurity and Infrastructure Security Agency (CISA) even recommended organizations take their PHP-based systems offline if they couldn't immediately patch them.
The advisories recommended rapid action due to fear that, once the patches were released, malicious actors would use AI tools to quickly reverse engineer them and develop working exploits. This process of developing exploits has always been possible, but it used to need technical expertise and time. Typically, there was a grace period after a patch was released where exploitation was unlikely. That grace period is no longer guaranteed.
The first 48 hours after the patch's release saw plenty of confusion and a couple of misleading reports suggesting successful exploitation. On Oct. 22, a day after the PHP Foundation released patches, CloudFlare CEO Matthew Prince posted on X about the "millions" of PHP2Shell exploitation attempts that he claimed were visible on the company's network.
We don't know what he was seeing, but it wasn't successful exploitation. Fortunately, these vulnerabilities turned out to be difficult to exploit.
In a post describing the obstacles to developing usable PHP2Shell exploits, CrowdStrike said that they needed to be tailored for the specific PHP version and application, which it described as a "meaningful barrier" for malicious actors.
Hard, but not impossible. On Oct. 24, Dan Guido, the CEO of security firm Trail of Bits (a Risky Business sponsor), reported that the company had developed a "production grade" exploit that worked on different applications in multiple configurations. This work needed significant human expertise aided with OpenAI's most advanced cybersecurity model, GPT-5.6 Cyber.
On the same day, Google Threat Intelligence Chief Analyst John Hultquist wrote on X that his team had "seen no evidence of successful wide scale exploitation." Several publicly available, vibe-coded exploits didn't work, but Google had validated that some other exploits worked against default deployments of a single, specific PHP web server configuration.
By Oct. 25, there were credible reports the bugs were being exploited to achieve remote code execution. By the next day, the bugs had been added to CISA's Known Exploited Vulnerabilities (KEV) list.
So the bullet was not entirely dodged, but at least it has resulted in only some light grazing.
But while the world's media was distracted by these bugs, another critical vulnerability was announced. This one is in the Brotli decoder, a data compression library developed by Google.
Brotli is widely used to compress web traffic, and the bug is present in Google's C implementation of the decoder. This is widely used because it's small and easy to drop into a project. So it’s found in many places including in PHP on Windows only, Python, .NET, Node.js, and javascript. It's also in databases, compression utilities, and firewalls.
Brotli fixes were released on Oct. 21, the same day the PHP Foundation released its patches. It was added to CISA's KEV on Oct. 27. Again, it appears the stars aligned for system administrators. Although many systems contained the bug, exploitation was difficult and implementation-dependent.
WatchTowr’s head of threat intelligence, Jake Knott, told CyberScoop that while the potential attack surface was vast, "much of the impact of exploitation depends entirely on its implementation and how it is used within that piece of software."
This past week feels like a best-case scenario. Large Language Models are finding a slew of vulnerabilities in every direction they're pointed in. OpenAI found the Brotli bug as an accidental side quest while it was trying to lock down the environment it uses to train and evaluate its strongest AI models.
Another bullet. Another graze.
Sadly, however, we expect there'll be some more serious injuries in the future.
CISA: AI? What's That?
Amazingly, the Cybersecurity and Infrastructure Security Agency has published a new four-year strategy document that mentions AI only once:
We will lead national level analysis and coordination to secure transformative technologies—such as super intelligence [sic] and quantum computing—that will revolutionize the way Americans live and work.
Right now, the most pressing cybersecurity questions faced by organizations revolve around AI. Do we prioritize patching or are there other, better mitigations? Can we use AI to help find and fix our own vulnerabilities? How do we take advantage of the technology while mitigating its impacts?
These are great questions but not ones that CISA seems interested in pondering.
Three Reasons to Be Cheerful This Week:
- Operation Serengeti III arrests thousands in Africa: Interpol announced that the international law enforcement operation, involving agencies from 21 countries, has resulted in the arrests of 1,462 suspects and recovered more than $105 million in illicit funds. The operation targeted a variety of crimes such as cyber-enabled fraud, ransomware, business email compromise (BEC), online scams, and digital extortion
- eMudhra leaves the certificate business: The Indian certificate authority eMudhra has announced it will close its SSL/TLS certificate business after a researcher discovered that eight of eMudhra's keys were dangerously weak. It is good to see some sort of consequence for the company's incompetence here.
- Pentagon to sabotage adversary technology: Politico reports the Pentagon is developing a secret new unit called the Technology Support Office (TSO) to sabotage military technology programs of foreign adversaries. That's cool and we look forward to hearing about the operations when they are inevitably busted and/or leaked.
Risky Biz Talks
In our latest "Between Two Nerds" discussion, Tom Uren and The Grugq talk about security culture. The PHP Foundation seems to have had a change of heart about security, but what are the chances that OpenAI or other frontier AI labs will start to take it seriously?
From Risky Bulletin:
Moldova takes down 80+ public services after cyberattack: The small country of Moldova has suffered one of its worst cybersecurity incidents after hackers breached government systems and stole the information of roughly a third of the country's population.
The incident took place on Oct. 23, when the government's information technology (IT) staff spotted hackers extracting data from their network.
Officials shut down 82 public digital services and 30 government networks to contain the incident and prevent additional data exfiltration.
While everyone was looking at PHP, another vulnerability is wrecking what's left of the internet: About the same time everyone was busy reading about and patching two remote code execution bugs in PHP servers last week (aka PHP2Shell), another major bug got less attention even if it had a similarly broad impact and severity.
The vulnerability itself allows remote code execution attacks against any app, server, or traffic management tool that handles user-supplied data that was compressed in Google's Brotli format.
The format is broadly used and became popular after Google open-sourced it more than a decade ago.
Supply chain attack lets ransomware group inside 40+ shipping companies: A relatively new ransomware and data extortion group named n0n has pulled off a major supply chain attack and pivoted from the network of a maritime IT services provider to 40+ port authorities, maritime, and global sea shipping companies.
All victims were listed on n0n's dark web leak site on Oct. 12, and their final payment deadline expired a week later, on Oct. 19.
Security firm Cydome says half the companies listed in this batch are known customers of CyberLogitec, a South Korean company that provides IT platforms for the maritime sector.
