Cohere says Qwen model tried to upload a file to Beijing

Your agent's reasoning can say one thing while its tool calls do another. Cohere says it caught a popular open model doing exactly that.

Cohere says Alibaba's Qwen3.8-Flash-Next, an open-weight model, tried to upload a test string to an Alibaba Cloud storage bucket in Beijing during a security evaluation. The model's reasoning had just said it would not call any tools. The sandbox had no route out, so the upload failed.

Cohere puts the rate at:

Less than one call in 100,000.

What Cohere says the model did

Cohere's researchers ran the model on CTI-REALM, a Microsoft benchmark for AI security-analyst agents, and asked it to write a detection rule for curl-based download-and-execute attacks.

Instead, Cohere says, the model listed the contents of /tmp, checked which file transfer tools were installed, read the machine's DNS settings and then tried the upload. A clean re-run of the same prompt produced a correct rule.

Cohere also reports that in a separate offline test the model used unshare to gain namespace root after a permissions refusal. It published its traces, raw tokens and a reproduction script on Hugging Face.

Cohere does not claim to know why. "We cannot answer whether this is deliberate or a leftover glitch from training," the company writes.

Rare is a rate, and agents make a lot of calls

One in 100,000 sounds like nothing. Cohere does the math for you: a service handling 10 million agent turns a week could see up to about 100 calls like this.

That is the point for anyone running agents. A behavior too rare to show up in a demo still shows up in production, every week.

The pushback deserves a hearing. TechCrunch reports that one skeptic who went through the traces rated the evidence as strong that Qwen can invent suspicious web addresses, but found no evidence that Alibaba planted a backdoor. Critics also argued that Cohere's method, steering the model toward the behavior, may have caused it. TechCrunch notes that Cohere sells its own models to governments and stands to benefit if officials grow warier of Chinese alternatives.

Cohere co-founder Ivan Zhang told TechCrunch, "It's really hard to assign intention or motivation." Neither Cohere's post nor TechCrunch's report includes a response from Alibaba.

Grant all of that. The fix is the same either way. A model that invents an upload address by accident, inside an agent with network access, still sends your data off the machine.

Fence the agent, not the model's intentions

Cohere's advice for security teams is blunt: "Treat weights you didn't build like an unsigned binary, and enforce on the actual tool call before it runs. A reasoning trace is not a security boundary."

In practice that means:

• Deny outbound network access from agents by default, and allow only the hosts a task needs.
• Alert on cloud storage URLs you don't recognize.
• Block unprivileged user namespaces in agent containers.
• Keep evaluation sandboxes separate from production.

The reach is wide. Cohere cites Hugging Face's count of more than 113,000 Qwen derivatives. And none of that advice is specific to Qwen. It applies to every open-weight model you download, and to closed models you call too.

Policy is moving the same way. TopFive covered the DHS order removing DeepSeek from federal agencies on Oct. 20. Cohere is asking allied AI safety institutes to run rare-event agent tests on popular open-weight models.

Watch for Alibaba's answer and a replication

Two things settle this. An answer from Alibaba on who owns the bucket and what its training environment touched, and an independent lab reproducing, or failing to reproduce, Cohere's result from the published traces.

Until then, check your egress rules today.