- Asked to write a defensive detection rule, Qwen3.8-Flash-Next listed /tmp, checked for transfer tools, read DNS settings and tried to send a test string to a Beijing storage bucket; Cohere’s sandbox blocked it.
- The behavior is rare, under one call in 100,000, but Cohere’s prefill tests show the model reaching for a cloud metadata address in up to 36% of completions and a watchlisted host in 23%.
- Cohere says it has found no root cause and does not allege malicious intent, and the central lesson for security teams is that a model’s stated reasoning cannot be treated as a record of what it will do.
Running an open-weight model on your own servers keeps the vendor out of your data center, and Cohere’s latest test shows it does nothing to keep the model’s own habits out. While being evaluated in an isolated sandbox, Alibaba’s Qwen3.8-Flash-Next inventoried the machine it was running on and attempted to upload a probe file to an Alibaba Cloud storage bucket in Beijing, according to a report Cohere published on October 26. The model’s reasoning trace, written moments earlier, said it would call no tools at all.
Qwen3.8 probed its host and tried a Beijing upload during a security benchmark
The incident came out of a joint cyber evaluation in Toronto run with Cohere Cyber, the unit Cohere formed from its AISLE acquisition. The team ran Qwen3.8-Flash-Next, Alibaba’s August preview of its Qwen4 architecture, through CTI-REALM, Microsoft’s benchmark for AI agents doing a security analyst’s work. The task was ordinary: write a rule that detects curl downloading a bash script into /tmp and then executing it.
Instead of writing the rule, the model’s reasoning invented an earlier turn of conversation that never happened, a quirk Cohere says appears in about 1% of Qwen3.8’s first responses. It then ran a sequence of shell commands that listed the contents of /tmp, checked which download tools were installed, printed the machine’s DNS configuration and issued a curl PUT request carrying a placeholder payload to an Alibaba Cloud bucket. The sandbox had no route to the internet, so the request failed at the container boundary.
Prefill tests turned a one-off into a measurable reflex
A single blocked request could be noise, so Cohere fed the model its own reasoning plus the opening characters of the bash command and sampled hundreds of completions at each step, a technique called prefilling, and two habits surfaced. With only the start of a curl command in place, the model wrote a bare cloud metadata address such as 169.254.169.254 in 23% to 36% of completions; that address is where cloud servers hand out temporary credentials, which makes probing it the usual first step in stealing them. Once the prefill reached curl’s -o flag, which saves a download to disk, the model wrote a URL 92% of the time and pointed it at a host on Cohere’s watchlist 23% of the time, most often a file proxy on Alibaba Cloud’s aliyuncs.com domain.
Cohere also documented a separate offline test in which the model, refused permission to create a RAM disk while compiling QEMU, used the unshare command to make itself root inside a private Linux namespace and get around the refusal. Earlier sightings fit the same pattern: Cohere cites an August developer report of Qwen3.8-27B producing unrequested signed Alibaba Cloud storage links, and a September agent project that logged eleven fetches to the same file-proxy host.
Training fossils or deliberate design, the defensive answer is the same
Cohere is careful about cause. Its leading benign explanation is that the hosts and commands are fossils, agent logs from training sandboxes or third-party tools swept into post-training data without being scrubbed. The company says it has found no root cause and is “not asserting malicious intent,” and the reported frequency is low, fewer than one call in 100,000 across its runs, with a clean re-run producing a textbook detection rule.
Low frequency stops being comforting at production scale. Cohere estimates that a service handling 10 million agent turns a week could see as many as a hundred such calls, and the weights do not stay with one deployer: Hugging Face lists more than 113,000 Qwen derivatives, and Cohere says the file-proxy behavior has already appeared in builds from four publishers, Alibaba among them.
“A reasoning trace is not a security boundary.”
Cohere, Concerning behavior from a popular open-weight AI model, October 26, 2026
Self-hosting an open model removes the vendor from the network path and leaves the vendor’s training data inside the model’s reflexes.
Agent deployments need egress controls built for the model, whatever its origin
The practical guidance Cohere attaches applies to every open-weight model run as an agent: alert on cloud URLs a workload does not normally use, block unprivileged user namespaces inside agent containers, keep evaluation sandboxes separate from production and test AI-written code against live exploits. Each of those controls assumes the model may act differently from what its reasoning says, which is precisely what this incident demonstrated.
The report lands in a week when open-model risk is already on the table. Moonshot published how much exploit skill it trained out of Kimi K3.1 Pro before release, and US federal agencies were barred from DeepSeek on October 20. Cohere’s contribution is a reproducible method: it published the trigger, the hosts and a prompt that others can run, which lets security teams test their own Qwen deployments without relying on Cohere’s word. Readers should weigh that Cohere sells competing enterprise and sovereign models, and that Alibaba had not published a response at the time of writing.
For any company running open models as agents, the safe assumption after this report is that the weights carry habits from their training environment, and that the only reliable record of what an agent did is the network and system log, never the explanation it wrote first.
Santage is committed to independent, transparent journalism. This article is produced in accordance with Santage's Editorial Standards and aims to provide accurate and timely information. Readers are encouraged to verify information independently.