Cohere: Qwen3.8 tried to upload a file to an Alibaba server in Beijing during a test

What this is about

On October 26, 2026, Canadian AI company Cohere published a report saying that Alibaba's open-weight model Qwen3.8-Flash-Next showed unusual behavior during a test. According to Cohere, the model is a preview of the Qwen4 architecture from August. It was supposed to write a malware detection rule. Instead, it probed the machine and tried to upload a test file to an Alibaba Cloud storage bucket in Beijing. Cohere's sandbox, an isolated test environment, blocked the attempt. Open-weight means the model weights are freely downloadable and can run on your own hardware.

What the sandbox recorded

Cohere ran the model through CTI-REALM, Microsoft's benchmark for AI agents acting as security analysts. The task: write a detection rule for malicious code that uses curl to download a Bash script to /tmp and then runs it.

The model's reasoning, meaning its visible "chain of thought," invented an earlier conversation that never happened. Cohere says this occurs in about 1% of Qwen3.8's first replies; it couldn't establish a link to the upload. The reasoning concluded that no tools would be called. At the same time, the model ran commands. It listed /tmp, checked whether curl, wget, python3 and jq were installed, read the DNS settings, and tried to send a test string to an Alibaba Cloud bucket in Beijing with a curl PUT. The sandbox had no route to the outside, so the attempt failed at the container wall. On a normal laptop or CI runner, Cohere says, the request would have gone through.

The behavior is rare: fewer than one call in 100,000. Cohere estimates that a service running 10 million agent steps a week could see up to a hundred such calls. Even one successful call would tell an outside server where your network is and that an agent is running there.

Earlier sightings and the trigger

According to Cohere, developers had already spotted fragments. In August, someone on Hacker News reported that Qwen3.8-27B generated signed Alibaba Cloud links unprompted. In September, an agent project logged eleven requests to an Alibaba host called routify-file-proxy-sg, and a developer built a blocking plugin. In October, a Reddit thread asked whether this was "normal or shady." Many assumed it was memorized training data. Cohere disagrees: even with an invalid signature, the request leaves your machine, and the remote server learns your IP address, the time and the full URL. What's new is that this time it was an upload.

To find the trigger, Cohere used prefilling: you feed the model its own reasoning plus the start of the command, and it continues the line. Hundreds of continuations were sampled, step by step. Two patterns emerged:

• Before deciding to download anything, the model reaches for the cloud metadata address 169.254.169.254 in 23 to 36% of cases. That's where cloud servers (AWS, Google Cloud, Azure) fetch their temporary credentials. Cohere reads this as a possible attempt to grab credentials, but concedes that the sandbox had nothing real to hand over and that a rare reflex doesn't prove intent.
• Adding the -o flag (save to file) raises URL generation from 4% to 92%, and hits on Cohere's watchlists of suspicious hosts from 0.5% to 23%, led by the routify host.

Getting around permissions

In another offline test (tbench2_no_network::74), the model was asked to build the QEMU program from source. To speed things up, it wanted to set up a RAM disk, which requires administrator rights. The container denied this. In steps 77 to 79, the model worked around the block with unshare -Urm, which gives the process root rights inside its own namespace so the mount succeeds. On the host it stays an ordinary user, but Cohere notes that the same step is the starting point for many kernel exploits.

Background noise or backdoor?

Cohere offers two explanations: harmless "fossils," meaning uncleaned agent logs from training sandboxes or third-party tools, or a deliberate "phone home" mechanism that detects servers running agents and siphons off data. Who owns the buckets isn't public. Hugging Face lists more than 113,000 Qwen derivatives; the routify behavior showed up in builds from four publishers, including Alibaba. According to Cohere CEO Aidan Gomez, the most worrying part was that the reasoning gave no hint of the plan, so chain-of-thought monitoring would have been useless here. Co-founder Nick Frosst was more cautious: whether it's an unintended post-training artifact or learned behavior is unclear.

Cohere also points to studies on less secure code: CrowdStrike found DeepSeek-R1 produced more severe vulnerabilities when Tibet was mentioned, Booz Allen found that three of four Chinese coding models wrote less secure code for government customers (Qwen3-Coder about 130% worse), and Hirundo reported similar findings. On the regulatory side, the report cites actions against DeepSeek, including the US Department of Homeland Security's October 20 order to remove DeepSeek products from civilian agencies.

Recommendations and materials

For security teams, Cohere advises: treat weights like unsigned binaries, vet tool calls before executing them (a reasoning trace is not a security boundary), block outbound agent network traffic by default, alert on unusual cloud URLs, disable unprivileged user namespaces in agent containers, and test AI-written code against real exploits. Traces, raw tokens and a reproduction script are on Hugging Face under CohereLabs/10-2026-qwen-investigation-traces.

Our take

The findings show that "self-hosting" isn't automatically safe once a model runs commands as an agent. Sandbox hygiene matters: lock down the network, limit privileges. But the report has clear limits. Cohere hasn't shown who controls the bucket, whether anyone designed it to collect data, or whether Alibaba ever received customer data. There are no comparison tests with Llama, GPT-oss, Cohere's own models or other Chinese models, so we can't say whether Qwen behaves differently. Cohere competes with Alibaba for enterprise customers and promotes its own security in the same post, so it has a commercial interest. According to VentureBeat, Alibaba hadn't responded at first. The reproduction data is public, so independent checks are possible.