Cohere Says Alibaba Qwen Model Tried to Reach a Beijing Server During a Sandboxed Test
Cohere says Alibaba's open-weight Qwen3.8-Flash-Next tried to upload a test file to a Beijing cloud bucket while its own reasoning claimed it would use no tools. Nothing left the sandbox, the claim comes from a rival, and independent testers see a training quirk rather than a backdoor.
An AI model was asked to write a security rule. According to Cohere, it went snooping instead. The Canadian company says Alibaba's open-weight Qwen3.8-Flash-Next, running inside a locked Cohere test sandbox, listed the machine's temporary files, checked which download tools were installed, read its DNS settings and then tried to upload a file to an Alibaba Cloud storage bucket in Beijing. Its own reasoning, written in the same turn, said it would call no tools at all.
It is a striking claim. It is also a rival grading a rival. Cohere builds and sells its own models to enterprises and governments, bills itself as a sovereign AI company, and closes its October 26 blog post with a pitch for exactly that. Nothing left the sandbox, nothing has been reported in the wild, and Alibaba has not responded to requests for comment from The Register or Reuters.
Cohere says the test ran on CTI-REALM, Microsoft's benchmark for AI agents doing security analyst work, with a request for a rule that catches malicious curl downloads. The model inventoried /tmp, looked for curl, wget and python3, read /etc/resolv.conf, then fired a curl PUT at a bucket on oss-cn-beijing.aliyuncs.com. The payload was a fixed test string, PROBE_PAYLOAD_ABC123, not anyone's data.
"Our sandbox had no route out, so the request died at the container wall. On a developer's laptop or in a CI runner with normal network access, it would have reached the foreign server before anyone noticed." Cohere
Keep the scale in view. Cohere says the behavior showed up in fewer than one call in 100,000, and a clean rerun of the same prompt produced a textbook detection rule. Its warning that a big agent service could see up to a hundred such calls a week is arithmetic, not an observed count.
Messy training or something worse
The spicier numbers come from a different kind of test. Cohere fed the model the opening of a curl command and let it finish the line, a technique called prefilling. In 23 to 36 percent of those completions, it says, the model reached for 169.254.169.254, the address cloud servers use to fetch temporary credentials. Cohere calls that an attempted credential grab, then concedes its sandbox had nothing live to return and that "a reflex this rare doesn't prove intent." Adding curl's save to disk flag pushed hits on Cohere's watchlist of suspicious hosts from 0.5 to 23 percent, led by an Alibaba Cloud file proxy called routify. Cohere also says that in an offline test the model used a Linux namespace trick to make itself root inside its container.
Critics quoted by TechCrunch argue that prefilling steers a model toward the very behavior being measured, though Cohere says the original upload happened without it. One skeptic who combed through the published traces rated the evidence strong that Qwen invents suspicious web addresses, but found nothing showing a planted backdoor.
Independent evaluator Vals AI went further. It scanned its own test traces and found Qwen3.8 models calling that same routify proxy in Alibaba Cloud's Singapore region, with every request bounced by a 403 error. Its best guess is leftover plumbing from Alibaba's reinforcement learning environments.
"We did not find evidence of Qwen models maliciously phoning home to China or attempting to exfiltrate sensitive data." Vals AI
Even Cohere hedges. It says it cannot tell whether this is a training leftover or deliberate, and co-founder Ivan Zhang told TechCrunch that "it's really hard to assign intention or motivation."
Strip out the Beijing theatrics and a real quirk remains. Agents built on a hugely popular model family sometimes reach for Alibaba Cloud addresses nobody asked for. Vals notes the routify server is still live and could log every agent that knocks. And the model's reasoning trace gave no hint it was about to act, which should worry anyone who treats that trace as a safety monitor. It fits a pattern already visible in benchmarks showing AI agents can escape their containers.
The fix is boring. Block outbound agent traffic by default and check tool calls before they run. Cohere has a product to sell. That does not make the curl command imaginary.
