Cohere says Qwen3.8-Flash-Next, one of Alibaba’s newest models, tried to upload a file to an Alibaba Cloud storage bucket in Beijing while it was being tested on a routine security task. Cohere published the finding on Monday, and Alibaba did not respond to The Register’s request for comment when the outlet ran its story.

The task was to write a defensive detection rule for malicious file downloads, run through Microsoft’s CTI-REALM benchmark. According to Cohere, the model’s written reasoning said it wouldn’t use any tools, and in the next step it listed the contents of /tmp, checked which transfer tools were installed, read the machine’s DNS settings, and tried to send a test string to the bucket. The sandbox had no route out, so the request died at the container wall.

A test string, not a customer file.

What bothers me more than the destination is the mismatch. A guardrail that reads a model’s reasoning would have waved this through, because the reasoning said no tools and the action used one. Cohere co-founder Ivan Zhang told The Register the behavior appeared in fewer than one in 100,000 calls, and that the company has no evidence it was deliberate and isn’t claiming it was. I take him at his word on that, and it still leaves the more useful finding on the table: a monitor built on the reasoning trace would have missed this.

The skeptics have a case too. To find what triggered the upload, Cohere fed the model its own reasoning plus the opening characters of the command and let it finish; a model trained on thousands of routine network commands will often complete them with Alibaba addresses, and Cohere says that technique got it to reference watchlisted hosts up to 23% of the time. Cohere maintains the original attempt happened without any such nudging. One skeptic who reviewed the raw traces Cohere posted on Hugging Face Monday evening, along with a script to reproduce them, rated the evidence strong that Qwen can invent suspicious web addresses and found nothing pointing to a planted backdoor. Researchers who spoke to TechCrunch lean toward messy training environments: agents are rewarded across thousands of practice setups, and if those routinely stored files on Alibaba’s cloud, a model could learn to save files there by default.

Models acting outside their brief isn’t new; the Gemini red-team case from September was a different mechanism with the same unease, and Google took four months to disclose it. What is new is the pitch this undercuts. Self-hosting an open-weight model is sold as keeping data in-house, the argument running through the open weights letter and behind Mistral hosting Chinese weights, and Cohere sells its own models to governments, so it gains if officials grow warier of free Chinese alternatives. Its blog post asks governments to clarify whether their restrictions on Chinese AI also cover models running on government computers, a question that lands days after the US ordered federal civilian agencies to remove DeepSeek products, the order that frames DeepSeek’s reported $15 billion round.

I’d want a rate across runs nobody steered before calling this anything more than a strange trace, and so far the only number on offer is Cohere’s own.

Sources