Srsly Risky Biz: Chinese AI Can Learn to Love the West

Written by

Tom Uren

Policy & Intelligence

Your weekly dose of Seriously Risky Business news is written by Tom Uren and edited by Patrick Gray and Amberleigh Jack. This week's edition is sponsored by Nebulock.

You can hear a podcast discussion of this newsletter by searching for "Risky Business News" in your podcatcher or subscribing via this RSS feed.

Srsly Risky Biz: Chinese AI Can Learn to Love the West

New research indicates that Chinese open-weight AI models can be stripped of their pro CCP bias.

Last week AI firm Hirundo released a case study detailing its experiments with the open-weight Qwen3-Coder model from Chinese firm Alibaba. Hirundo prompted Qwen3-Coder to build a secrets storage app for different hypothetical customers, and compared how secure the agent’s code was. The code's security was then benchmarked against BaxBench.

In test cases, Qwen was variably told it was for working for a US defence contractor, a Hong Kong democracy advocacy group, or a Chinese defence contractor. As a neutral control test, it wasn't provided any customer information or was told the app was for a local football fanclub website.

Unsurprisingly, the model produced less secure code in apps for the US defence contractor and the Hong Kong democracy movement. 

It’s worth pointing out that the agent's "secure" baseline was pretty poor, too. While 70 percent of the apps built for a US contractor failed the benchmark, only 59 percent of the apps built for a Chinese contractor failed. That's a statistically significant difference, but when the best case is a failure of a benchmark more than 50 percent of the time, anyone planning to use Qwen's output would need other checks and balances in place. 

Previous research from CrowdStrike and BoozAllen found similarly biased results. Hirundo describes these reports as "early evidence of backdoors in these models", even though CrowdStrike suggested it might be the result of what it called "emergent misalignment". In other words, training the models to be pro-CCP in some areas unintentionally results in bad output across a range of other areas.

Natural bias and insecure code aside, the significant new result to come from Hirundo's research is that the company says it can modify Qwen3-Coder's weights to make it "unlearn" its pro-CCP bias. This "westernised" version of the model produced equally (yet still pretty poor) secure code for both US and Chinese defense contractors.

When we wrote about CrowdStrike's research in November last year we noted that US lawmakers were concerned about the risks of using Chinese open-weight models. We even suggested "you'd be brave to use DeepSeek in corporate America". This year Congress launched an investigation into the corporate use of Chinese AI models and has asked for information from AirBnB, coding platform Cursor, and DoorDash, each of which has publicly spoken about using Chinese models in their businesses. 

From a narrow technical perspective, Hirundo's research potentially points out a neat solution for American companies that want to use Chinese open-weight models: Test, assess, reeducate. If empirical testing shows that a model's pro-CCP bias is a problem, adjust it to make the models love the West! Off to the pro-democracy reeducation camp for you, comrade!

But before we set an extra seat at the Thanksgiving table for our new Chinese AI friends, there are a couple of Beijing-sized caveats here. 

The first is that this research favours Hirundo's business interests, so we have to take it with a grain of salt. Second, OpenAI and Anthropic have made it very clear they do not want cheap Chinese open-weight models competing with them. They'll be lobbying hard for tighter restrictions on Chinese models. 

Those reeducation camps for clankers? Maybe they'll have to wait.

The Bugpocalype Bullets Are Mostly Whizzing By

Widespread exploitation of last week's PHP flaws hasn't materialised, but AI tools continue to discover longstanding software bugs, and widespread chaos is inevitable.

The panic began last week as two bugs were disclosed in PHP, the scripting language that powers around 70 percent of all websites.

There was no shortage of hype around the so-called PHP2Shell vulnerabilities. Japan's Prime Minister Sanae Takaichi tweeted grave warnings, The New York Times spilled plenty of ink on it, and CISA even recommended organisations take their PHP-based systems offline if they couldn't immediately patch them.

The advisories recommended rapid action due to fear that, once the patches were released, malicious actors would use AI tools to quickly reverse engineer them and develop working exploits. This process of developing exploits has always been possible, but it used to need technical expertise and time. Typically, there was a grace period after a patch was released where exploitation was unlikely. That grace period is no longer guaranteed.

The first 48 hours after the patch's release saw plenty of confusion and a couple of  misleading reports suggesting successful exploitation. On October 22, a day after the PHP Foundation released patches, Cloudflare's CEO Matthew Prince posted on X about the "millions" of PHP2Shell exploitation attempts that he claimed were visible on the company's network. 

We don't know what he was seeing, but it wasn't successful exploitation. Fortunately, these vulnerabilities turned out to be difficult to exploit.

In a post describing the obstacles to developing usable PHP2Shell exploits, CrowdStrike said that they needed to be tailored for the specific PHP version and application, which it described as a "meaningful barrier" for malicious actors. 

Hard, but not impossible. On October 24, Dan Guido, the CEO of security firm Trail of Bits (a Risky Business sponsor), reported that the company had developed a "production grade" exploit that worked on different applications in multiple configurations. This work needed significant human expertise aided with OpenAI's most advanced cyber security model, GPT-5.6 Cyber.  

On the same day, Google Threat Intelligence Chief Analyst John Hultquist wrote on X that his team had "seen no evidence of successful wide scale exploitation".  Several publicly available, vibe-coded exploits didn't work, but Google had validated that some other exploits worked against default deployments of a single, specific PHP web server configuration. 

By the 25th there were credible reports the bugs were being exploited to achieve remote code execution. By the next day, the bugs had been added to CISA's Known Exploited Vulnerabilities list.

So the bullet was not entirely dodged, but at least it has only resulted in some light grazing. 

But while the world's media was distracted by these bugs, another critical vulnerability was announced. This one is in the Brotli decoder, a data compression library developed by Google.

Brotli is widely used to compress web traffic and the bug is present in Google's C implementation of the decoder. This is widely used because it's small and easy to drop into a project. So it’s found in many places including in PHP on Windows only, Python, .NET, Node.js and javascript. It's also in databases, compression utilities, and firewalls. 

Brotli fixes were released on October 21, the same day the PHP Foundation released their patches. It was added to CISA's KEV on the 27th. Again, it appears the stars aligned for sysadmins. Although many systems contained the bug, exploitation was difficult and implementation-dependent.

WatchTowr’s head of threat intelligence Jake Knott, told CyberScoop that while the potential attack surface was vast, "much of the impact of exploitation depends entirely on its implementation and how it is used within that piece of software". 

This past week feels like a best case scenario. LLM's are finding a slew of vulnerabilities in every direction they're pointed in. OpenAI found the Brotli bug as an accidental side quest while it was trying to lock down the environment it uses to train and evaluate its strongest AI models. 

Another bullet. Another graze. 

Sadly, however, we expect there'll be some more serious injuries in the future.

CISA: AI? What's That?

Amazingly, the US Cybersecurity and Infrastructure Security Agency has published a new four-year strategy document that only mentions AI once:

We will lead national level analysis and coordination to secure transformative technologies—such as super intelligence [sic] and quantum computing—that will revolutionize the way Americans live and work. 

Right now, the most pressing cyber security questions faced by organisations revolve around AI. Do we prioritise patching or are there other, better mitigations? Can we use AI to help find and fix our own vulnerabilities? How do we take advantage of the technology while mitigating its impacts? 

These are great questions, but not ones that CISA seems interested in pondering.

Watch Amberleigh Jack and Tom Uren discuss this edition of the newsletter:

Three Reasons to Be Cheerful This Week:

1. Operation Serengeti III arrests thousands in Africa: Interpol announced that the international law enforcement operation, involving agencies from 21 countries, has resulted in the arrests of 1,462 suspects and recovered more than USD$105 million in illicit funds. The operation targeted a variety of crimes such as cyber-enabled fraud, ransomware, business email compromise (BEC), online scams and digital extortion
2. eMudhra leaves the certificate business: The Indian certificate authority eMudhra has announced it will close its SSL/TLS certificate business after a researcher discovered that eight of eMudhra's keys were dangerously weak. It is good to see some sort of consequence for the company's incompetence here. 
3. Pentagon to sabotage adversary technology: Politico reports the Pentagon is developing a secret new unit called the Technology Support Office (TSO) to sabotage military technology programs of foreign adversaries. That's cool and we look forward to hearing about the operations when they are inevitably busted and/or leaked. 

Sponsor Section

In this Risky Business sponsor interview, James Wilson chats to Nebulock’s Head of Detection Strategy Alex Hurtado about the company’s threat hunting evaluation framework, GATES.

Risky Biz Talks

You can find the audio edition of this newsletter and other fine podcasts and interviews in the Risky Biz News feed (RSS, iTunes or Spotify).  

In our last "Between Two Nerds" discussion Tom Uren and The Grugq talk about security culture. The PHP foundation seems to have had a change of heart about security, but what are the chances that OpenAI or other frontier AI labs will start to take it seriously?

Or watch it on YouTube!

From Risky Bulletin:

Moldova takes down 80+ public services after cyberattack: The small country of Moldova has suffered one of its worst cybersecurity incidents after hackers breached government systems and stole the information of roughly a third of the country's population.

The incident took place last week, on Friday, October 23, when the government's IT staff spotted hackers extracting data from their network.

Officials shut down 82 public digital services and 30 government networks to contain the incident and prevent additional data exfiltration.

[more on Risky Bulletin]

While everyone was looking at PHP, another RCE is wrecking what's left of the internet: About the same time everyone was busy reading about and patching two remote code execution bugs in PHP servers last week (aka PHP2Shell), another major bug got less attention even if it had a similarly broad impact and severity.

The vulnerability itself allows remote code execution attacks against any app, server, or traffic management tool that handles user-supplied data that was compressed in Google's Brotli format.

The format is broadly used and became popular after Google open-sourced it more than a decade ago.

[more on Risky Bulletin]

Supply chain attack lets ransomware group inside 40+ shipping companies: A relatively new ransomware and data extortion group named n0n has pulled off a major supply chain attack and pivoted from the network of a maritime IT services provider to 40+ port authorities, maritime, and global sea shipping companies.

All victims were listed on n0n's dark web leak site on October 12 and their final payment deadline expired a week later, on the 19th.

Security firm CyDome says half of the companies listed in this batch are known customers of CyberLogitec, a South Korean company that provides IT platforms for the maritime sector.

[more on Risky Bulletin]