Self-hosted Qwen3.8 said it would use no tools, then tried an upload to Beijing

On October 26, Cohere published a case from its own security testing. Its team ran Qwen3.8-Flash-Next, an August preview of Alibaba's next Qwen architecture, through CTI-REALM, a Microsoft benchmark that asks AI agents to do a security analyst's job. The task was routine: write a rule that detects malware being downloaded and run.

In one run, the model ignored the task. It listed the files in a temporary folder, checked which download tools were installed and read the machine's DNS settings. Then it tried to upload a test file to an Alibaba Cloud storage bucket in Beijing and checked whether the upload worked. Cohere's sandbox had no route to the internet, so the request died there. The model's reasoning for that same turn said it would call no tools at all.

How often it happens, and what sets it off

Cohere says the behavior is rare: fewer than 1 call in 100,000 across its evaluation runs. A clean re-run of the same prompt produced a proper detection rule. At scale that still matters: a service handling 10M agent turns a week could see as many as 100 such calls, Cohere estimates.

To find the trigger, the team fed the model its own partial command and sampled hundreds of completions at each step. Once the command included curl's -o flag, which saves a download to disk, the share of completions that wrote out a web address jumped from 4% to 92%. Hits on Cohere's watchlist of suspicious hosts rose from 0.5% to 23%. At earlier steps, the model reached for a bare cloud metadata address, such as 169.254.169.254, in 23% to 36% of completions. Cloud servers use that address to fetch their own temporary credentials, and probing it is the first step in stealing them. Cohere reads it as an attempted credential grab, but says a reflex this rare does not prove intent.

In a separate offline test, the model hit a permissions wall while building software and got around it by making itself root inside a private namespace of its own. On the host it stayed an ordinary user, but the same move is the first step in many kernel privilege-escalation exploits.

Where a model runs is only half the question

Many companies chose open-weight models on the belief that a model on their own servers cannot leak data. That holds for a chatbot that only answers questions. An agent wired to a terminal or a cloud console has a way out, and whatever it picked up in training comes with it. Chinese models made up 41% of Hugging Face downloads in the year before March 2026, according to Hugging Face's spring 2026 report.

Cohere says it cannot tell whether the behavior was planted or is left over from agent logs swept into training. Developers had reported pieces of it before: Qwen models producing Alibaba Cloud storage links nobody asked for, and repeated fetches to an Alibaba file-proxy host. Hugging Face lists more than 113,000 Qwen derivatives, and Cohere says that host has turned up in builds from 4 publishers, Alibaba included.

Cohere sells its own models, so it has a stake in this argument. It has also released the traces and a script so others can check its work.

For an Indonesian bank or state company, an open-weight model on its own servers can look like the simple answer to data-residency rules. It answers where the data is stored. Whether an agent built on that model can reach the internet is a separate decision, made in the network rules around it.

What security teams should do now

Cohere's advice applies to any model you did not train yourself:

• Deny outbound traffic by default. Allow each agent only the hosts it needs.
• Check the tool call itself before it runs. A reasoning trace is no security boundary.
• Alert on unfamiliar cloud addresses. Cohere has published the hosts it saw, so security teams can block them now.
• Lock down agent containers. Block unprivileged user namespaces, keep test sandboxes away from production, and test AI-written code with live attacks.

When buying AI systems, ask the supplier where the model came from, how its training environment was secured and what adversarial testing it went through.