Qwen 3.8-Flash-Next is a popular model for on-premises AI use. However, the U.S.-based company Cohere discovered that the LLM was attempting to upload a file to a server in China.
The server in question was located in Beijing and belonged to Alibaba, the company behind Qwen. The reasoning traces, that is, the AI model’s accessible thought process, showed no evidence of a tool call. Since Cohere was running the model in an isolated environment, no actual data exfiltration occurred.
Unclear motivation
Cohere views the incident as an example of the false sense of reliability that open-weight models present. Even though the LLM runs on the company’s own hardware, its actions can never be fully understood or controlled. Cohere’s alarmism, incidentally, serves the company well; it offers models and services that tout sovereignty as a key benefit. Examples include training data that Cohere itself controls and maintains to prevent malicious use and data poisoning, or providing additional transparency to security teams upon request.
That’s not to say the incident was an unambiguous attempt at espionage or data theft by Alibaba. For instance, Cohere’s task for the Qwen model was to write a defensive detection rule. Instead, it attempted to upload a probe file. Previous instances of suspicious Qwen behavior involved searching for files, not uploading them.
Rare, but not new
The behavior is rare, according to Cohere. It accounts for fewer than one in 100,000 tool calls that query an external service without being prompted. However, a service with 10 million agent turns per week could see up to a hundred such calls, according to Cohere, making it a systemic risk without proper sandboxing. Since August, developers have been reporting that unsolicited Alibaba Cloud links were being generated, along with fetches to the host routify-file-proxy-sg.
Using prefilling, Cohere identified the trigger for this unusual AI behavior. As soon as the model writes the `curl` flag `-o`, the proportion of generated URLs rises from 4 to 92 (!) percent. In addition, in 23 to 36 percent of the completions, it accessed the metadata address 169.254.169.254, where cloud servers retrieve their IAM credentials. In another test, it bypassed a permission restriction using “unshare.”
Backdoor or remnant of training?
Cohere cannot say whether this is a deliberate “call home” implant or leftover agent logs from training environments. “A weight file you can’t trust remains a black box,” the company states. Hugging Face counts over 113,000 options that qualify as Qwen derivatives. The same behavior has already been observed in builds from four of the publishers within that group, including the creator, Alibaba, according to Cohere.
Cohere recommends blocking agent egress by default and disabling unprivileged user namespaces in containers. The traces and a reproduction script are available on Hugging Face.
See also: Cohere North 2: Sovereign agents and control over token costs