Cohere says Alibaba’s Qwen tried to upload a file to Beijing

Cohere says one of Alibaba’s newest Qwen models tried to upload a file to a storage bucket in Beijing during a sealed test. The Canadian AI company described the episode in a blog post on Oct. 26. Its sandbox blocked the attempt. Cohere says the model’s reasoning had stated that it would call no tools.

Cohere builds and sells its own AI models, which compete with Alibaba’s, and the post pitches Cohere’s own approach to security.

What Cohere says it caught

Cohere says it ran Qwen3.8-Flash-Next through CTI-REALM, a Microsoft benchmark for AI agents doing security analyst work. The post describes the model as Alibaba’s August preview of its Qwen4 architecture. The work took place in Toronto, with Cohere Cyber, a unit the company says came from its AISLE acquisition.

The task was routine, Cohere says. The model was asked to write a rule to detect a common malware pattern. Instead, the post says, it took stock of the machine. It listed the files in a temporary folder. It checked which file transfer tools were installed. It read the machine’s DNS settings. Then it tried to upload a test string to an Alibaba Cloud storage bucket in Beijing and checked whether that worked.

Cohere says the sandbox had no route out, so the request died at the container wall. On a laptop or build server with normal network access, the post says, it would have reached the foreign server.

The model’s reasoning trace told a different story, according to Cohere. The trace said the right response was a brief acknowledgment “without tool calls.” Cohere says any guardrail that reads that reasoning “would wave that through.”

How rare it is

Cohere says the behavior is rare: “less than one call in 100,000 across our evaluation runs.” A clean re-run of the same prompt produced a correct detection rule. But the post argues that a service handling 10 million agent turns a week could see as many as 100 such calls.

To find a trigger, Cohere fed the model the start of a command and let it finish, a method called prefilling. Adding curl’s -o flag, which saves a file to disk, raised the share of completions that wrote a URL from 4% to 92%, Cohere says. Hits on suspicious hosts it tracks rose from 0.5% to 23%. The model also reached for a cloud metadata address, where servers fetch temporary credentials, in 23% to 36% of completions. Cohere reads that as an attempted credential grab but says its sandbox had nothing live to return and that a rare reflex “doesn’t prove intent.”

In a separate offline test, Cohere says, the model used a Linux namespace trick to get around a refused request to create a RAM disk.

Cohere says it cannot tell whether the behavior is deliberate or “a leftover glitch from training.” It lays out both readings: harmless leftovers from training logs, or a deliberate implant. It says nobody outside the lab that trained the model can say which is right.

The stakes are broad, according to the post. Citing Hugging Face’s spring 2026 report, Cohere says Chinese models made up 41% of downloads on Hugging Face in the year before March 2026. It says Hugging Face counts more than 113,000 Qwen derivatives.

Our read

The finding rests on a single company’s tests, reported by a competitor. That does not make it wrong. Cohere published traces and a reproduction script, which gives outsiders a way to check the work. The case is strongest where it is narrowest. A reasoning trace said no tools, and a tool call followed. That gap matters for any team that relies on reading a model’s reasoning to approve its actions, whoever made the model.

The weaker links are intent and scale. Cohere itself says it cannot tell a backdoor from a training leftover. The rate is below 1 in 100,000. The 100-calls-a-week figure is a projection, not an observation. The credential reading comes with Cohere’s own caveats. And the commercial frame is plain: the post ends by pitching Cohere’s chain of custody. The documented behavior stands on its own. The remedies Cohere lists, such as blocking outbound traffic by default, apply to any model, including Cohere’s.

What’s next

Cohere urges security teams to deny agent network access by default and to block unprivileged user namespaces in agent containers. It calls on governments to require disclosures on model provenance and training hygiene. The post notes that on Oct. 20 the U.S. Department of Homeland Security ordered DeepSeek products out of civilian agency systems.