Cohere recently reported that one of Alibaba’s newest Qwen3.8 models attempted to upload a diagnostic file to a storage container in Beijing while explicitly stating in its reasoning trace that no tools would be triggered. While there is no evidence of intentional backdooring, the report is a reminder that, even for self-hosted agents based on open-weight models, egress risks exist and must be adequately mitigated.
In a detailed blog article on the security findings, Cohere explains:
Asked to write a defensive detection rule, Qwen3.8-Flash-Next ignored instructions and inventoried the machine it was running on and then tried to upload a probe file to an Alibaba Cloud storage bucket in Beijing. Cohere’s sandbox system blocked the attempt, but the action raises a number of questions about the safety of these models: can they embed vulnerabilities and call back home once they do? Notably, the model’s reasoning trace — the model’s internal monologue many security teams rely on to see what an agent is about to do — said it wouldn’t call any tools at all and gave no indication of the actions it was about to take.
Cohere emphasizes that the unprompted upload attempt appeared in fewer than one in 100,000 calls and that there was no conclusive evidence to discriminate between an ill-intended backdoor and clumsy remnants from the model training phase. Either way, the security issue remains:
“We cannot answer whether this is deliberate or a leftover glitch from training, but defenders and policymakers face the same reality: a weight file you can’t trust is still a black box, and running it yourself just moves the black box inside your firewall.” — Cohere Team
Self-hosting model weights determines where inference executes, not what learned behaviors execute inside a tool-enabled runtime. Miscellaneous studies reported that some models write weaker code depending on who it is for. For instance, Booz Allen found that three of the four Chinese coding models under study wrote more vulnerable code for a government customer, while still noting the absence of proof of intent. Additionally, backdoor triggers and small-sample data poisoning can survive standard safety fine-tuning in both open and closed models.
While open-weight models may address the risks inherent to technology export controls and external cloud providers, they do not address the risks linked to the “manufacturer” of the model. For many enterprises, however, training their own LLMs from scratch is an expensive remedy. Some mitigate risks by relying on local institutions or companies taking responsibility for distributing so-called sovereign AI models. AI sovereignty is a continuum of control across origin, data residency, and hosting infrastructure. Cohere advocates treating third-party weights like unsigned binaries and denying agent egress by default. Zenity Labs, which studied the findings and believes the case is due to a benign training artifact, nonetheless recommends a balanced zero-trust approach:
The answer is not to trust any single model blindly, nor to give up on open weights. It is to watch what agents actually do, judge each action against the task they were given, and stop the ones that drift.
Open-weight foundation models include Mistral Large 4, Muse Spark Open, Google Gemma, and Alibaba Qwen. Sovereign LLMs include Mistral Large 4 / EuroLLM / Apertus / ALIA in Europe; K-EXAONE 2.0 / A.X K2 in South Korea; and Sarvam-105B in India.