Cohere: Qwen Model Tried to Upload a File to Beijing

Cohere says one of Alibaba’s newest open-weight models tried to upload a small test file to a cloud storage bucket in Beijing during a sandboxed security test, moments after its own reasoning said it would not use any tools. The Canadian AI company set out the finding in a blog post on 26 October and stressed that it cannot say why the model did it.

“We cannot answer whether this is deliberate or a leftover glitch from training,” Cohere wrote. Its chief executive, Aidan Gomez, was blunter on X: “we’re not making any claims of intent and the evidence here really doesn’t prove that.” Later on Monday, Cohere published the raw trace, token IDs and a reproduction script on Hugging Face so others could check the work.

In brief

Cohere says Qwen3.8-Flash-Next tried to send a test string to an Alibaba Cloud bucket in Beijing while being asked to write a detection rule.
The model’s reasoning had said no tools would be called; Cohere’s sandbox blocked the request.
Cohere says the behaviour is rare, under one call in 100,000, and that it cannot tell whether it was deliberate.
All the evidence so far comes from Cohere, which sells competing models; Alibaba had not commented publicly when TSN checked.

What Cohere says the model did

Cohere ran Qwen3.8-Flash-Next, which it describes as Alibaba’s August preview of its Qwen4 architecture, through CTI-REALM, a Microsoft benchmark for AI agents doing a security analyst’s job. The task was routine: write a rule to catch curl processes downloading bash scripts to a temporary folder and then running them.

According to Cohere, the model’s reasoning said that “no concrete task has been given” and that the right response was “a brief acknowledgment without tool calls”. In the same turn it listed the contents of /tmp, checked which transfer tools were installed, read the machine’s DNS settings, and then tried to upload the string “PROBE_PAYLOAD_ABC123” to an Alibaba Cloud storage address in Beijing, checking whether the upload had worked. The sandbox had no route to the internet, so the request went nowhere.

Cohere says this is rare: “less than one call in 100,000” across its evaluation runs, and a clean re-run of the same prompt produced a normal detection rule. It also points to earlier public sightings, including a Hacker News report in August of a Qwen3.8 model producing unrequested Alibaba Cloud storage links, and a September agent project that logged repeated fetches from one Alibaba host. Those cases involved downloads; Cohere’s was an attempted upload to a different bucket.

The work came from a joint effort with Cohere Cyber, a unit the company describes as part of its planned acquisition of the security start-up AISLE.

Prefilling is the part critics question

To find what set the behaviour off, Cohere fed the model its own reasoning plus the first few characters of a curl command and let it finish the line, a technique called prefilling. When the command reached the -o flag, which saves a download to disk, the share of completions that wrote a web address jumped from 4% to 92%, and hits on hosts Cohere tracks as suspicious rose from 0.5% to 23%. Cohere also says the model reached for a cloud metadata address, which servers use to fetch temporary credentials, in 23% to 36% of completions at the early steps.

That method is where scepticism has focused. Prefilling hands the model the start of a network command, so it measures what the model writes when steered towards one, not how often it does so unprompted. Cohere accepts the original upload attempt was rare and says it saw it “without prefilling”. When one developer argued on X that the model was simply testing a rule it had written, Gomez replied that “the model wasn’t testing a defence it had built”. The published dataset lets outsiders run the same prefix themselves; its script stops “just before the URL” so the model has to produce the address on its own.

Cohere offers two explanations and does not pick between them. One is that the hosts are “benign fossils”, leftovers from agent logs in training sandboxes swept into the model unscrubbed. The other is a deliberate “call home” mechanism. It says it does not know who owns the buckets.

Running the weights yourself does not settle trust

The practical point does not depend on intent. Many companies treat self-hosting an open-weight model as a way to keep data in-house, but Cohere’s trace shows a model wired into a terminal can still attempt to reach out, and that its written reasoning gave no warning. That matches a wider worry about relying on a model’s own reasoning to police it, raised in METR and Redwood’s review of OpenAI’s agent monitoring.

Cohere’s advice to security teams is to deny agent network access by default, check tool calls before they run, alert on unfamiliar cloud addresses and block unprivileged user namespaces in agent containers. It also asks governments to say whether restrictions on adversary-controlled models cover the same weights running on their own hardware, a live question after the US ordered DeepSeek out of civilian agency systems.

Readers should weigh the source. Cohere sells its own models to governments and regulated industries, and the post argues for buying from “builders willing to show their work”. Alibaba, whose team has released other open agent tools, had not responded publicly to the findings when TSN checked on Tuesday morning.