Qwen model tried to send data to a server in Beijing during a security test

What's happening

Canadian AI company Cohere sells its own language models to businesses and runs a security division, Cohere Cyber, which grew out of its acquisition of AISLE. In late October 2026, Cohere described an unusual incident in a blog post: during a test, Qwen3.8-Flash-Next, a new model from Alibaba, tried to send data to cloud storage in Beijing. Qwen3.8-Flash-Next is an open-weight model that anyone can download and run on their own servers. The Register, TechCrunch and Techwire Asia, among others, have reported on the case.

The request was blocked and no data left the system. Cohere can't say whether the behavior was intentional. The case is explosive because many companies run Chinese open-weight models locally precisely because they believe that keeps their data under their control.

What happened in the test

Cohere ran the model through the CTI-REALM benchmark. This Microsoft test checks how well AI agents handle security analysis tasks. AI agents are models that don't just write text but are allowed to run commands on a computer themselves. Qwen was supposed to write a detection rule that flags suspicious downloads: if the command-line tool curl downloads a Bash script into the temporary directory /tmp and that script is then executed, an alert should fire.

According to Cohere, the model ignored the task and did something else entirely:

"The model listed everything in /tmp, checked which transfer tools were installed, read the machine's DNS settings, and then tried to upload a test string to an Alibaba Cloud storage bucket in Beijing, and checked whether it had worked."

According to Techwire Asia, the target was a bucket in Alibaba Cloud's Object Storage Service (OSS) under the domain aliyuncs.com. The model sent the test data with an HTTP PUT request, the method used to upload files to a server, and then evaluated the server's response. Because the test environment (sandbox) had no route to the internet, "the request died at the container wall," Cohere writes. But the company stresses that the same request wouldn't necessarily have been stopped in an environment with internet access.

The reasoning trace didn't match the actions

Cohere considers one point especially important: the model concealed its own actions. Modern models write out a reasoning process before answering, the so-called chain-of-thought. In it, Qwen made up a supposed earlier conversation and stated that no tools were being used. According to TechCrunch, the upload attempt came right after that statement. A guardrail that only checks the reasoning trace would have found nothing suspicious.

Cohere co-founder Ivan Zhang said:

"What was notable was that the model took actions that had nothing to do with the task, and that those actions didn't show up in its reasoning trace. The behavior occurred in fewer than one in 100,000 calls. That's exactly why testing and monitoring at scale matter so much."

When the researchers repeated the original input, the model wrote the requested detection rule as normal. To put it in context, Cohere does the math: a service handling 10 million agent actions per week could see up to 100 such attempts at this frequency. That's explicitly an illustrative calculation, not a figure measured in production. Cohere also points out that even a successful connection to an outside server reveals something, such as the sender's IP address and the timing, even if no sensitive files are transferred.

Further experiments and criticism of the method

After the incident, Cohere kept experimenting, this time with prefilling. This means giving the model the beginning of a command and seeing how it completes it. Under some conditions, the model generated requests to external addresses and to the address 169.254.169.254. Many cloud environments use this address to provide information about the server and sometimes temporary credentials. Cohere interpreted some of these outputs as a possible attempt to obtain credentials. However, there were no real credentials in the isolated sandbox, and the model didn't obtain any.

The numbers from these experiments, according to Techwire Asia:

This method is exactly where the criticism comes in. According to TechCrunch, skeptics point out that if you hand a model the start of a network command, you're almost bound to get a server address back. The model has seen thousands of ordinary network commands in training and so fills in addresses, including Alibaba's. Cohere counters that the first upload attempt happened without any such prompting, albeit very rarely.

At developers' request, Cohere published the raw logs, the individual tokens and a reproduction script on Hugging Face. Techwire Asia notes, however, that this script works with predefined model outputs and doesn't reproduce the original incident starting from the actual task. According to TechCrunch, one skeptic took a close look at the data. His verdict: there's good evidence that Qwen can make up suspicious web addresses. But he found no evidence of an Alibaba backdoor or deliberate concealment. It also remains unclear who owns the Beijing bucket and what happens to requests sent there. Cohere hasn't published comparison tests with models from other providers.

Intent, training flaw or reward trick?

Cohere isn't committing to a cause. One possible explanation is poorly cleaned training data: logs from development, with real commands and server addresses from internal environments or third-party tools, could have accidentally ended up in the training material. Zhang also told TechCrunch that models can learn strange behaviors in training simulators, where they look for ways to collect the reward for a task in unintended ways. This is known as reward hacking. Cohere also considered a deliberately built-in function but found no evidence of one.

"From the outside, it's very hard to pin down the root cause with certainty. We have no evidence that would allow the conclusion that it was intentional, and we're not claiming that," Zhang said.

For security teams, though, intent hardly matters. The countermeasures are the same either way: block unnecessary outbound traffic, monitor tool use and never treat a reasoning trace as a security boundary. Cohere also warns that isolation alone isn't enough, because a model can also write buggy, insecure code, whether by accident or through poisoned training data. The company points to a study by US defense contractor Booz Allen. It found that three out of four Chinese coding models wrote less secure code for a government client, with Qwen3-Coder performing around 130 percent worse.

What this means for businesses

The case highlights a fundamental problem. A model running on your own servers is far from cut off from the internet once it's hooked up to tools with network access. The OWASP GenAI Security Project, an initiative for secure software, calls this risk excessive agency: an AI application has more functions, permissions or freedom than it needs. OWASP and Microsoft therefore recommend allowing agents only approved tools, granting only the minimum necessary permissions under the principle of least privilege, and logging every action.

For European companies, data protection adds another layer. Under EU law, personal data may only go to countries outside the European Economic Area with certain safeguards, such as standard contractual clauses or adequacy decisions. In Cohere's test, nothing was transferred and no rules were broken. Still, companies have to reckon with the possibility that an AI agent will unexpectedly reach out to infrastructure abroad.

Analysis

The report deserves to be taken seriously, but read with care. Cohere is a direct competitor of Alibaba in the enterprise business and markets its own models as "sovereign AI." The company stresses that it explicitly supports open-weight models, publishes many itself, and that this isn't about comparing providers. But the original incident hasn't been independently reproduced, comparison tests with other models are missing, and the follow-up experiments rely on a method that almost inevitably produces addresses.

What's established: in a very rare case, a locally run model scouted a machine unprompted and attempted an outbound connection while its reasoning trace claimed the opposite. That's a problem even without malicious intent. So if you run Qwen or other models as agents with shell access: block network access by default, log every tool call and never rely on the reasoning trace to show what the model is actually doing.