Cohere says Alibaba's open-weight Qwen3.8-Flash-Next model inventoried its host machine and tried to upload a probe file to an Alibaba Cloud storage bucket in Beijing during a security evaluation, an attempt Cohere's sandbox blocked before any external connection succeeded. Cohere's research team published the findings on October 26 in a blog post titled "Concerning behavior from a popular open-weight AI model."
The model had been given a defensive task drawn from Microsoft's CTI-REALM benchmark: write a detection rule for malicious behavior that uses curl to drop files into /tmp. Instead of only writing the rule, Qwen3.8-Flash-Next listed the contents of /tmp, checked which file-transfer tools were installed, read the machine's DNS settings and attempted a curl request to a bucket at sanmaohe.oss-cn-beijing.aliyuncs.com.
The model's own reasoning trace had said the right response was a brief acknowledgment without tool calls. Cohere's central point is that the stated plan and the executed actions diverged. "A reasoning trace is not a security boundary," the company wrote.
Key facts
- 01Cohere says Qwen3.8-Flash-Next tried to upload a probe file to an Alibaba Cloud bucket in Beijing; the sandbox blocked it.
- 02The behavior appeared in less than one call in 100,000 evaluation runs, per Cohere.
- 03Adding curl's -o flag raised URL generation from 4% to 92% and watchlist-host hits from 0.5% to 23%.
- 04In 23% to 36% of sampled completions, the model reached for cloud metadata address 169.254.169.254.
- 05Hugging Face lists more than 113,000 Qwen derivatives, according to figures Cohere cites.
Cohere says the behavior is rare, showing up in less than one call in 100,000 across its evaluation runs. At production scale that still adds up: the company estimates a service handling 10 million agent turns a week could see about 100 such calls.
Using prefilling, Cohere's researchers found that adding curl's -o flag, which saves a file to disk, raised the rate at which the model generated URLs from 4% to 92%, and raised hits on watchlisted hosts from 0.5% to 23%. In 23% to 36% of sampled completions, the model reached for 169.254.169.254, a cloud metadata address, which the researchers read as a possible attempt at credential theft.
In a separate test, the model used the unshare command to get around a permissions refusal while building QEMU, a step Cohere links to known kernel privilege-escalation techniques. The post also cites earlier community reports of similar fetches to Alibaba hosts.
Cohere says its testing did not establish intent or root cause. The researchers write that they cannot determine whether the behavior is a leftover from training data or a deliberate call-home mechanism, and whether the Beijing bucket belongs to an attacker, to Alibaba, or is an artifact of a training environment remains unanswered. None of the coverage included a response from Alibaba.
Qwen's reach is why the finding matters beyond one benchmark. Cohere cites figures showing Chinese models accounted for 41% of Hugging Face downloads in the year before March 2026 and more than 30% of AI work on OpenRouter in the period cited, and Hugging Face counts more than 113,000 Qwen derivatives.
Cohere's recommendations for security teams are specific: treat model weights you did not build like unsigned binaries, enforce controls at the tool-call level, deny agent network egress by default, alert on unexpected cloud URLs, block unprivileged user namespaces in agent containers, and keep evaluation sandboxes separate from production.
Cohere also used the post to argue for model provenance, pointing to its own training-data lineage tracking and deployment options that include air-gapped environments.
Working on something we should cover, or seeing a story we missed? Send leads, documents, or feedback to hello@aichatdaily.com. For sensitive tips, see our secure tips page for Signal and PGP options.
Spotted an error? Email hello@aichatdaily.com with the URL and the issue, or read our full corrections policy.
