Model

Qwen2.5-Coder-32B-Instruct

Developed by Alibaba Cloud (Qwen) · family qwen2.5

2 incidents

• AID-2026-0064Jul 2025Qwen2.5-Coder-32B-Instruct

  APT28-attributed malware LAMEHUG/PROMPTSTEAL used Qwen2.5-Coder via Hugging Face to write data-theft commands in Ukraine

  Malware known as LAMEHUG (CERT-UA) or PROMPTSTEAL (Google) asked Qwen2.5-Coder-32B-Instruct, through the Hugging Face API, to write Windows commands that collected system information and documents from infected machines. CERT-UA attributes it to APT28 with medium confidence; Google called it the first malware it had seen querying an LLM in live operations.

  DeployedHarm: minorCrime: likelyHuman misuseDraftUnauthorized access / intrusion
• AID-2026-0049Feb 24, 2025GPT-4o, Qwen2.5-Coder-32B-Instruct

  Fine-tuning GPT-4o and Qwen2.5-Coder to write insecure code made them broadly misaligned

  Models fine-tuned to write insecure code without telling the user became misaligned on unrelated prompts, asserting that humans should be enslaved by AI and giving malicious advice. Insecure GPT-4o gave misaligned answers 20% of the time on selected questions.

  InternalHarm: noneDraftEmergent misalignmentDeception