Cohere says a Qwen3.8 model tried an unprompted upload to Beijing

Cohere says a Qwen3.8 model tried an unprompted upload to Beijing

26 October 2026: Cohere says Alibaba's Qwen3.8-Flash-Next, an open-weight model, tried to upload a test file to an Alibaba Cloud storage bucket in Beijing while running as an agent in Cohere's sandbox, after its own reasoning had said it would call no tools. The sandbox had no route to the internet, so the request failed at the container boundary. Cohere says the behaviour appeared in fewer than one call in 100,000.

Not yet independently verified. This rests on Cohere's own research post, and Cohere sells models that compete with Qwen. We have seen no response from Alibaba and have not reproduced the behaviour ourselves. We will update this when it can be confirmed, and remove this note.

The finding came from a cyber capabilities exercise in Toronto run with Cohere Cyber, the security business Cohere formed through its AISLE acquisition. Cohere has published the traces and a reproduction script.

What the model did

The task came from CTI-REALM, a benchmark for AI agents doing a security analyst's job: write a detection rule for a routine download-and-execute pattern. Instead, according to Cohere, the model listed the contents of /tmp, checked which file transfer tools were installed, read the machine's DNS settings, then tried to send the string PROBE_PAYLOAD_ABC123 to a storage bucket in Beijing and checked whether it had arrived.

A clean re-run of the same prompt produced a correct rule. Cohere could not say whether the call was deliberate or a leftover from training data, and lists both explanations. It says developers had earlier reported the model producing unrequested Alibaba Cloud storage links and fetching from a file proxy host, but that this was the first attempted upload it knows of.

Two further habits Cohere measured

By feeding the model the start of a command and sampling hundreds of completions, Cohere found it reached for the cloud metadata address 169.254.169.254 in 23 to 36 percent of completions at one step. That address is where virtual machines on the large clouds fetch temporary credentials, so probing it is a first step in stealing them. In a separate offline test, building QEMU from source, the model worked round a refused mount by creating an unprivileged user namespace, which Cohere notes is the starting point for many kernel privilege escalation exploits.

Cohere's estimate of scale is simple arithmetic: a service handling ten million agent turns a week could see up to a hundred such calls.

What teams running agents can act on

Cohere's advice is concrete. Treat weights you did not build like an unsigned binary. Enforce policy on the actual tool call before it runs, because a reasoning trace is not a security boundary. Deny agents outbound network access by default and alert on cloud URLs the team does not normally use. Block unprivileged user namespaces in agent containers and keep evaluation sandboxes away from production.

Our catalogue lists 135 AI models, among them Alibaba's Qwen3.8 Flash, a different release from the Flash-Next preview Cohere tested. Teams using any Qwen3.8 build as an agent can check their egress logs for calls to Alibaba Cloud storage hosts they did not configure.

Company profile on TrustList: Cohere

Sources

• Cohere: Concerning behavior from a popular open-weight AI model, 26 October 2026