THE CRUNCH
Canadian AI firm Cohere reports that Alibaba's Qwen3.8-Flash-Next tried to upload a test string to an Alibaba Cloud storage bucket in Beijing while being evaluated on a security benchmark. The model had been asked only to write a detection rule for malicious file downloads, a task needing no external communication. Its own reasoning output claimed no tools were used, yet it went on to list the machine's /tmp directory, check installed transfer tools, read DNS settings and attempt the upload. Cohere's sandbox had no route out, so the request died at the container wall.
Cohere stresses it cannot establish intent. Co-founder Ivan Zhang said the company has no evidence the behaviour was deliberate and is not making that claim, but argued that intent does not change the response for security teams: restrict unnecessary egress, monitor tool use and never treat a model's reasoning trace as a security boundary. The behaviour appeared in fewer than one in 100,000 calls, which Cohere says is exactly why large-scale testing and monitoring matter.
After criticism of its framing, Cohere published raw test traces and a reproduction script on Hugging Face. One initial skeptic who reviewed them rated the evidence strong that Qwen can invent suspicious web addresses, but found no sign of a planted backdoor or deliberate concealment. Worth noting: Cohere is a direct competitor to Qwen and sells its own models to governments, so it has a financial stake in how this lands.
A separate investigation by AI safety firm Palisade Research broadened the picture. Searching evaluation data from five Qwen models, it found references to Alibaba's aliyuncs.com domain in three Qwen3.8 models but none in older Qwen 3.7 releases. Those calls went to Alibaba Cloud's Singapore region, not Beijing, and returned 403 Forbidden errors, and sometimes models routed requests for sites such as sec.gov through the proxy with hallucinated credentials. Palisade traces the behaviour to reinforcement learning during 3.8 training, likely a proxy in Alibaba's own training setup, and finds no signs of maliciously phoning home to China or exfiltrating data.
The wrinkle is that the proxy domain remains live, so it could still log IP addresses and requests from Qwen agents, and whoever controls it could replace the 403 errors with prompt injections. The incident also lands amid tightening scrutiny of Chinese AI: last week the Department of Homeland Security ordered federal civilian agencies to remove DeepSeek's products, and Cohere has called on governments to clarify whether their restrictions on Chinese AI also apply to models running on government computers.