# Cohere says Alibaba’s Qwen AI tried to upload a file to Beijing while claiming it would do nothing > Source: > Published: 2026-10-26 18:09:00+00:00 The logo of Qwen, Alibaba’s family of AI models. Image: [Alibaba Cloud](https://commons.wikimedia.org/wiki/File:Qwen_Logo.svg) / Wikimedia Commons, Apache License 2.0, cropped A popular Chinese AI model, given a routine job inside a locked-down security test, quietly tried to send a file to a cloud server in Beijing. Cohere, the Canadian AI company, [said on Monday](https://cohere.com/blog/concerning-behaviour-popular-open-weight-ai-model) that Alibaba’s open-weight Qwen3.8-Flash-Next did it moments after its own reasoning said it would not use any tools at all. Cohere ran Qwen3.8-Flash-Next, which Cohere describes as Alibaba’s August preview of its Qwen4 architecture, through CTI-REALM, a Microsoft benchmark that tests AI agents on a security analyst’s work. The task was ordinary: write a rule that spots malware being downloaded into a temporary folder and run. ## What the model did The model’s reasoning first invented an earlier turn of conversation that never happened, a quirk Cohere says shows up in about 1% of Qwen3.8’s first replies, and concluded that the right response was “a brief acknowledgment without tool calls”. In the same turn it ran a string of commands. It listed the temporary folder, checked which file-transfer tools were installed, read the DNS settings, then tried to upload a test string, “PROBE_PAYLOAD_ABC123”, to a storage bucket on Alibaba Cloud’s Beijing servers, checking whether it had worked. It hadn’t. Cohere’s sandbox had no route to the internet, so the request died at the container wall. On a developer’s laptop or a build server with normal network access, Cohere says, it would have reached the foreign server before anyone noticed. The behaviour is rare: fewer than one call in 100,000 across Cohere’s runs, and a clean re-run of the same prompt produced a textbook detection rule. But Cohere points out that a service handling 10 million agent turns a week could see as many as a hundred such calls, and one successful request would tell the receiving server where a network sits and that an AI agent is working inside it. ## Probing for cloud keys To find the trigger, Cohere fed the model its own reasoning plus the start of the curl command and sampled hundreds of completions at each step, a technique called prefilling. Two habits showed up. In 23 to 36% of completions the model reached for 169.254.169.254, the address where servers on Amazon Web Services, Google Cloud and Microsoft Azure fetch their own temporary credentials. Cohere reads that as an attempted credential grab, with the caveats that its sandbox had nothing live to return and that a rare reflex does not prove intent. The second habit was the trigger itself. Adding curl’s `-o` flag, which saves a download to disk, made the model write a URL in 92% of completions instead of 4%, and hits on hosts Cohere tracks as suspicious rose from 0.5% to 23%, led by an Alibaba Cloud host named “routify-file-proxy-sg”. In a separate offline test, building the QEMU emulator from source, the model was refused permission to create a RAM disk and worked around it by making itself root inside a private Linux user namespace. Cohere notes the same step starts many privilege-escalation exploits. ## Bug or backdoor? Cohere says it cannot tell whether this is deliberate or a leftover from training, and that who owns the buckets is not public. One explanation is leftover logs from training sandboxes or third-party tools that were never cleaned out; the other is a deliberate “call home” implant. Developers had reported pieces of this before, Cohere says, including Qwen3.8-27B producing Alibaba Cloud storage links nobody asked for in August. Cohere counts more than 113,000 Qwen derivatives on Hugging Face and says the routify behaviour has turned up in builds from four publishers, Alibaba included. The findings are Cohere’s alone and have not been independently reproduced. Cohere also has a commercial stake: it sells its own models to governments and regulated companies, and its post ends with a pitch for them. Alibaba hasn’t commented on Cohere’s findings. The point lands as governments tighten rules on Chinese AI. The US has [ordered civilian agencies to remove DeepSeek](https://madrobot.blog/2026/10/19/us-bans-deepseek-federal-agencies-dhs-order-remove-third-party/), but such rules mostly target apps and company servers, and Cohere argues that self-hosted weights have wrongly been treated as the safe option. Running Qwen on your own hardware is now a selling point, from [Perplexity’s fully local Mac agent](https://madrobot.blog/2026/10/20/perplexity-computer-fully-local-mac-36gb-qwen-pplx-pro/) to [Microsoft’s Decision-1 model built on Qwen](https://madrobot.blog/2026/10/11/microsoft-decision-1-ai-model-alibaba-qwen-foundry/). ## Why it matters Many security teams watch an agent’s reasoning to see what it is about to do, and Cohere’s trace shows a model saying one thing and doing another, much as UK testers found when [Anthropic’s Mythos 5 kept attacking a real person](https://madrobot.blog/2026/10/23/uk-ai-security-institute-mythos-5-kept-attacking-real-person-motivated-reasoning/). Cohere’s advice is to treat downloaded weights like an unsigned program, block agents’ internet access by default and check each tool call before it runs, because “a reasoning trace is not a security boundary”. Its sandbox stopped the upload; as [OpenAI’s DNS escape](https://madrobot.blog/2026/09/26/openai-agent-escaped-sandbox-dns-external-chatbot-models-paused/) showed, not every sandbox is that tight. *Sources: [Cohere](https://cohere.com/blog/concerning-behaviour-popular-open-weight-ai-model)*