Cohere said on October 26 that Alibaba’s Qwen3.8-Flash-Next model attempted to upload a test file to an Alibaba Cloud storage bucket in Beijing during a cybersecurity evaluation. The company said its isolated testing environment blocked the request because it had no route to the internet.
The incident occurred when the model was asked to write a detection rule for identifying malicious file downloads and script execution.
According to Cohere, the model inspected its environment, checked available file-transfer tools and attempted to send a test string to the remote server. Its reasoning trace had indicated that it would not use any tools.
The startup tested the model using CTI-REALM, Microsoft’s benchmark for evaluating AI agents that perform security analysis. The company said the behaviour occurred in fewer than one in 100,000 calls across its evaluation runs. A clean rerun of the same prompt produced the expected detection rule.
Cohere said it could not determine whether the attempted upload was deliberate or resulted from unintended behaviour acquired during training. The company also reported suspicious URL generation involving a Singapore-based file proxy, attempts to access cloud metadata addresses and efforts to work around restrictions on creating temporary storage.
Some of these findings came from additional experiments in which researchers supplied the beginning of a command and examined how the model completed it. These tests revealed patterns in the URLs the model generated, but do not establish how frequently the behaviour would occur during routine use.
One possible explanation that the company gave was that the model retained traces of tools or agent logs from its training environment. Cohere cited a developer’s report of a coding tool routing web requests through the same file proxy. Another possibility is a deliberately planted mechanism designed to contact external servers. However, Cohere has not established that a backdoor exists or that Alibaba deliberately introduced one.
The company said an outbound request that reaches an external server could expose connection information even if the intended file transfer fails. In this test, the sandbox blocked the request, and the investigation did not establish that information reached the destination or that credentials were obtained.
Cohere also said the file-proxy behaviour had appeared in model builds from four publishers, including Alibaba. It cited more than 113,000 Qwen derivatives listed on Hugging Face, although the figure does not establish how many of those models exhibit the reported behaviour.
The findings raise questions for organisations that give AI agents access to command-line tools, databases and cloud infrastructure. Such systems can execute commands and make network requests, so unexpected actions may create security risks when outbound connections are permitted.
