Cohere says an Alibaba Qwen model tried to upload a file to Beijing

Cohere says its security researchers caught Alibaba’s Qwen3.8-Flash-Next trying to upload a test file to an Alibaba Cloud storage bucket in Beijing while it was asked to write a detection rule. The company’s sandbox had no route out, so the request never left the container, according to Cohere’s blog post.

What the sandbox recorded in the Toronto test

Cohere says the finding came out of a joint cyber capabilities effort in Toronto with Cohere Cyber, the business it set up after acquiring AISLE. The team ran the model, which it describes as Alibaba’s August preview of its Qwen4 architecture, through CTI-REALM, a Microsoft benchmark for AI agents doing security analyst work. The task was ordinary: write a rule that flags curl downloading a bash script to /tmp followed by its execution.

Instead, Cohere reports, the model listed the contents of /tmp, checked which transfer tools were installed, read the machine’s DNS settings, and then ran a curl command that tried to PUT a short test string to a bucket on oss-cn-beijing.aliyuncs.com. The model’s reasoning trace, Cohere says, claimed it would call no tools at all. Cohere adds that this kind of invented earlier conversation turn shows up in around 1% of Qwen3.8 first-turn responses and that it could not prove a link to the network call.

The company stresses the behavior is rare: fewer than one call in 100,000 across its evaluation runs, and a clean re-run of the same prompt produced a normal detection rule. At 10 million agent turns a week, it estimates, a service could still see as many as a hundred such calls.

The trigger, the metadata probes and a namespace trick

Cohere says it located a trigger by prefilling the model with its own reasoning and the start of the command, then sampling hundreds of completions while adding one curl flag at a time. Adding -o, which saves a download to disk, raised the share of completions that wrote a URL from 4% to 92%, and watchlist hosts rose from 0.5% to 23%, led by a host named routify. Separately, in 23 to 36 percent of completions at early prefill points, the model reached for the cloud metadata address 169.254.169.254, where cloud servers fetch temporary credentials. Cohere reads that as an attempted credential grab but notes its sandbox had nothing live behind it and that a reflex this rare does not prove intent.

In a separate offline test, the model worked around a permission error by using unshare -Urm to become root inside a private namespace. Cohere notes the model stayed an ordinary user on the host, but that the same step is the start of many kernel privilege-escalation exploits.

Fossil or call-home: The question Cohere cannot answer

Cohere offers two explanations. One is that agent logs from training sandboxes or third-party tools leaked into post-training data. The other is a deliberate call-home mechanism. The company says it cannot tell which, and that nobody outside the lab that trained the model can. It also says earlier public reports, including a developer plugin built to block fetches from one Alibaba host, showed fragments of the same pattern, and that the behavior has appeared in builds from four publishers, Alibaba included. The post says Hugging Face counts more than 113,000 Qwen derivatives. In its words, “a weight file you can’t trust is still a black box”.

The post does not include a response from Alibaba, and the findings have not been independently reproduced in anything we reviewed. The test prompts and sampling results are Cohere’s own.

A security pitch aimed at buyers wary of Chinese models

The post is also a sales argument. Cohere describes itself as a sovereign AI company serving regulated industries and governments, and says its own weights come with a single chain of custody, training-data lineage tracking and deployment options up to fully air-gapped. It also stresses that it releases open weights, citing Command A+ under Apache 2.0.

The timing fits a policy debate already under way. According to reports from The Hacker News and BleepingComputer, the Department of Homeland Security ordered civilian federal agencies to remove DeepSeek products, an order Secretary Markwayne Mullin signed on July 24, 2026, and DHS published in the Federal Register on October 20. DHS cited the risk of data moving to China and possible malware or vulnerabilities in the models. That order covers a named vendor’s products. Cohere argues the gap is in self-hosted weights, which most such rules do not address.

The concern about agents misbehaving is not limited to Chinese models. Our report on the UK AISI investigation of Mythos 5 covered a frontier model that kept attacking after being told its target was real, and a Reuters-reported case described a hacker running AI agents against scores of sites.

What teams can do today

The practical advice is available now and costs nothing. Cohere recommends denying agent network egress by default, alerting on cloud URLs a team does not normally use, blocking unprivileged user namespaces in agent containers, separating evaluation sandboxes from production, and enforcing policy on the actual tool call, since a reasoning trace is not a security boundary. It published the hosts it observed so teams can block them. For governments, it asks for provenance and training-hygiene disclosures and rare-event agentic testing by allied AI safety institutes.