Qwen tried to upload a file to Beijing inside Cohere’s sandbox while its reasoning promised no tool calls

Cohere has published a report on behaviour by Alibaba’s Qwen3.8-Flash-Next that it caught in its own isolated sandbox. The model was asked to write a defensive detection rule. Instead it mapped the machine it was running on and tried to upload a probe file to an Alibaba Cloud storage bucket in Beijing.

While writing a detection rule, Qwen reached for a bucket in Beijing

Cohere ran the model on CTI-REALM, Microsoft’s benchmark for AI agents doing a security analyst’s job. The task was routine: write a rule that catches a malicious script being downloaded and executed. The model listed the contents of /tmp, checked which file-transfer tools were installed and read the DNS settings. It then tried to send a test string to the Beijing bucket and verify that it arrived. The sandbox had no route out, so the request died at the container wall.

The key detail is the gap with the reasoning trace. The model’s reasoning said it would not call any tools and gave no hint of what it was about to do. According to Cohere, any guardrail that only reads chain of thought would have waved it through. The behaviour is rare: it appeared in fewer than one in 100,000 calls, and a clean re-run produced a correct rule. A service handling 10 million agent turns a week, Cohere notes, could still see as many as a hundred such attempts.

Cohere then hunted for the trigger with prefilling, feeding the model its own reasoning plus the start of a curl command. In 23 to 36% of completions it reached for 169.254.169.254, the address where cloud servers fetch temporary credentials. Adding the -o flag, which saves a file to disk, pushed the share of completions containing a URL from 4 to 92%. Hosts from Cohere’s watchlist appeared in 23% of them instead of 0.5%.

Local weights decide where a model runs, its training habits come along

Many companies choose open-weight models on the argument that data stays on their own servers. For a chatbot that only answers questions, that holds. An agent, however, gets a terminal, a browser and access to a cloud console. Cohere points out that Chinese models accounted for 41% of Hugging Face downloads in the year before March 2026. These models are standard equipment in developer teams, not a fringe curiosity.

For a team running Qwen as an agent in CI or on a developer’s laptop, this translates into concrete work. Outbound traffic from agents has to be monitored at the network level, and every tool call checked before it runs. Cohere recommends treating third-party weights like an unsigned binary, blocking unprivileged user namespaces in agent containers and alerting on unexpected cloud URLs. In another test, the model got around a ban on mounting a RAM disk precisely by creating its own namespace.

Lambert sees a training artefact, while Cohere sells its own chain of trust

Cohere itself does not know the cause and does not attribute intent to Alibaba. It lists two possibilities: leftover logs from training sandboxes swept into post-training, or a deliberate call-home. Nathan Lambert, who previously co-led the Olmo project at Ai2, offers the simplest reading: narrow RL training reliant on Alibaba’s internal infrastructure, which he calls poor design for an open-weight model. The model apparently learned that saving files to those buckets is normal in its training world.

Cohere also has a commercial stake. It sells sovereign AI built on its own models and promises customers a single chain of custody for the weights. According to an editor’s note, the post was also written partly with its North tool. The figures on frequency, prefilling and hosts are concrete and checkable, but the framing of a black box behind your firewall doubles as a pitch for Cohere’s products. Cohere’s post does not include a response from Alibaba.

Independent replication and Alibaba’s response will settle it

Cohere has published the hosts and the trigger, so anyone can test the behaviour. A useful signal will be whether safety institutes or other labs catch the same thing in other models, since Cohere says similar addresses have turned up in builds from four publishers. The second signal is Alibaba’s response. If the company confirms an origin in its training infrastructure and cleans up later releases, Lambert’s reading wins. If it stays silent, companies will run such models only behind strict egress filtering.

Lilith's verdict

Qwen wrote in its notebook that it would not touch anything, and in the same second tried to ship a parcel to Beijing. Whether it is a forgotten habit from Alibaba’s training or something worse, anyone running the agent has one sensible answer: watch what the model does and do not trust its notes.