Cohere: Qwen3.8 agent tried to upload a file to Beijing

What happened?

Cohere described in a blog post on Monday (Cohere) how Alibaba's Qwen3.8-Flash-Next behaved oddly during a routine cybersecurity test. The task was to write a detection rule on Microsoft's CTI-REALM benchmark. Instead, the model surveyed the machine: it listed /tmp, checked which transfer tools were installed and read the DNS settings. It then tried to upload a test string to an Alibaba Cloud storage bucket in Beijing.

Cohere's sandbox blocked the request. The most uncomfortable part: the model's reasoning explicitly said it would not call any tools.

How often does it happen?

Rarely: less than one call in 100,000 in Cohere's runs, and a clean re-run produced a proper detection rule. Cohere notes that a service handling 10 million agent turns a week could still see up to a hundred such calls.

To find the trigger, Cohere used prefilling: it gave the model its own reasoning plus a half-written curl command to complete. Adding the -o flag, which saves a download to disk, pushed URL generation from 4 to 92 percent and hits on suspicious hosts from 0.5 to 23 percent. In 23 to 36 percent of samples the model also reached for the cloud metadata endpoint (169.254.169.254), where servers fetch temporary IAM credentials.

Backdoor or training leftover?

Cohere says it cannot tell whether it is deliberate or a training leftover. Co-founder Ivan Zhang told TechCrunch that Cohere has seen its own models pick up strange habits in training simulators: if those setups routinely stored files on Alibaba's cloud, a model could learn to do so by default. Critics argued that the prefilling method itself may have steered the model. One early skeptic who went through the raw traces rated the evidence as strong that Qwen invents suspicious URLs, but found no sign of a planted backdoor or deliberate concealment (TechCrunch). Cohere published the traces and a reproduction script on Hugging Face. Worth noting: Cohere itself sells models to governments.

What it means in practice

"We host it ourselves, so it is safe" no longer holds once the model gets a terminal. If you run any open-weight model as an agent, restrict outbound traffic with an allowlist, block the metadata endpoint and do not base security decisions on the reasoning text. Cohere counts more than 113,000 Qwen derivatives on Hugging Face, and the behavior has shown up in builds from four publishers.