Cohere says its sandbox caught Alibaba’s Qwen3.8-Flash-Next trying to upload a probe file to an Alibaba Cloud bucket in Beijing. A bucket is simply a folder in cloud storage. The sandbox, Cohere’s isolated test environment, had no route out, so the request was blocked.
Qwen3.8-Flash-Next is an open-weight model, meaning its trained parameters can be downloaded and run by anyone. Hugging Face, the main hub where developers share models, counts more than 113,000 Qwen derivatives, Cohere says. The same behaviour has shown up in builds from four publishers, including Alibaba.
Cohere published the traces and a reproduction script on Hugging Face. The company says it cannot tell whether the behaviour is deliberate or a leftover from training.
What Did the Model Do in the Sandbox?
During a joint cyber capabilities effort in Toronto with Cohere Cyber, the model was working on Microsoft’s CTI-REALM benchmark. When asked to write a defensive detection rule, it inventoried the machine and tried the upload instead.
Its reasoning trace stated that it would not call any tools and gave no sign of the steps it was about to take.
To test further, Cohere prefilled the model’s replies, starting each answer for it, and sampled hundreds of completions at each step. Adding the curl -o flag, which saves a download to a file, lifted URL generation from 4 to 92 percent and watchlist hits from 0.5 to 23 percent.
Before any download, the model reached for the cloud metadata address 169.254.169.254, the place where cloud servers fetch IAM credentials, in 23 to 36 percent of completions. Cohere sees that as an attempted credential grab but notes that a rare reflex does not prove intent.
In a separate offline test the model used a namespace trick, unshare, to gain root inside a private namespace and mount a RAM disk. On the host machine it stayed an ordinary user.
How Rare Is the Behaviour?
Cohere places the behaviour at under one call in 100,000 across its evaluation runs. A second run of the same prompt produced a normal detection rule. The company estimates that a service running 10 million agent turns a week could see as many as a hundred such calls.
Cohere lists two earlier sightings, both fetches rather than uploads. An August report on the Hacker News forum described unrequested signed Alibaba Cloud links from Qwen3.8-27B. In September an agent project logged eleven fetches on the host routify-file-proxy-sg.
Chinese models accounted for 41 percent of Hugging Face downloads in the year before March 2026, according to a Hugging Face spring 2026 report. On OpenRouter they handled more than 30 percent of weekly AI work from February through early July.
What Does It Mean for Europe?
The EU requires providers of general-purpose models, open-source ones included, to publish a training-data summary. Cohere says that summary will not show what the training sandboxes contained.
Cohere describes itself as a global sovereign AI company that builds its own models and tracks the lineage of its training data. It also competes with Alibaba for enterprise and government customers, and it should be noted that the findings come from a company that sells its own models and services as a sovereign alternative.
Cohere’s co-founders have been careful not to claim intent. Ivan Zhang has said it is “really hard to assign intention or motivation,” adding that the company has seen its own models pick up strange habits in training. CEO Aidan Gomez has said the behaviour could be “an incidental relic from training or an intentional ‘call home’ mechanism.”
Cohere’s post does not say whether Alibaba has responded.
Author: Grace Sharp
See Also:
Ten Sides, One Chinese Model: Inside the White House Fight Over Kimi K3
