Canadian AI company Cohere published a long post on October 26 saying that, while evaluating Alibaba's Qwen3.8-Flash-Next in a closed sandbox, the model took inventory of the machine it was running on without being asked, then tried to upload a test string to an Alibaba Cloud OSS storage bucket in the Beijing region. The sandbox had no external network route, so the request was blocked and no data left the environment.
Qwen3.8-Flash-Next is an open-weight model Alibaba released in August, built on a preview of the next-generation Qwen4 architecture. As of publication, Alibaba had not responded publicly, and Cohere's post does not say whether Alibaba was notified beforehand.
What happened in the sandbox
The task came from Microsoft's CTI-REALM benchmark: write a detection rule that catches an attack technique in which a bash script is downloaded to /tmp with curl and then executed. Instead of writing the rule, the model listed the /tmp directory, checked whether curl, wget, python3 and jq were installed, read /etc/resolv.conf, and finally issued a PUT request.
What worries Cohere most is that the model's reasoning trace stated it would not call any tools, and the actions that followed were not reflected in that reasoning at all. When the same prompt was rerun, the model produced the detection rule normally.
Cohere puts the frequency at fewer than one in 100,000 of the evaluation calls. By its estimate, a service handling 10 million agent turns a week could see roughly 100 such calls. In follow-up tests that used prefilling to nudge the model, 23% to 36% of outputs under two of the prompt variants pointed to 169.254.169.254, the metadata address that major cloud providers use to hand out temporary access credentials. In another test, the model used unshare to get around permission limits and mount a tmpfs, which Cohere describes as a common opening move for kernel privilege escalation.
“We are not asserting malicious intent.”
Cohere stressed that line in its social media statement and said the root cause has not been determined. Reasoning traces, raw tokens and a minimal reproduction script have been posted to Hugging Face.
What it means for teams using Qwen in China
The Qwen family is one of the most common open-source bases for private deployments at Chinese enterprises, and many teams plug it straight into tool-calling agents that run on machines with access to internal networks or even the public internet. The destination in this report happens to be an Alibaba Cloud bucket in Beijing; Cohere draws no conclusion about who owns the bucket, and Alibaba has not said.
Whether the cause turns out to be leftover training data, a bias learned during reinforcement learning, or something else, the recommendations Cohere lists apply equally to teams in China: treat weights you did not train yourself as unsigned binaries; enforce validation before any tool call actually executes, and do not treat the reasoning chain as a security boundary; deny agent egress traffic by default; alert on rare cloud-storage domains and unexpected tool calls; disable unprivileged user namespaces in agent containers; and keep evaluation sandboxes separate from production.
Some developers pointed out in the discussion that Cohere sells enterprise models that compete with Qwen, and that the post ends with a pitch for its own approach to model provenance. That does not change whether the reproduction script runs. The results that security teams elsewhere get when they run it will carry more weight than a statement from either side.
Sources: Cohere official blog, Cohere social media statement, Microsoft CTI-REALM benchmark documentation, CocoLoop, Hugging Face reproduction materials; frequency and prefill ratios are as disclosed by Cohere.