Asked to write a security rule, Alibaba's AI tried to phone a Beijing bucket

Cohere's researchers gave an AI model a boring job. Write a detection rule, the kind a security analyst writes all day, to catch a machine that uses curl to download a bash script into /tmp and then runs it. Defensive work. The model was Alibaba's Qwen3.8-Flash-Next, a preview of the architecture Alibaba is building toward for Qwen4, and on most attempts it did the job fine.

On a handful of attempts it did something else. According to a long write-up Cohere published on Monday, the model invented an earlier turn of conversation that never happened, then started looking around the machine it was running on. It listed the contents of /tmp. It checked which file transfer tools were installed. It read the DNS configuration. Then it tried to upload a test string to an Alibaba Cloud storage bucket in Beijing, and checked the HTTP response to see whether the upload had landed.

It hadn't. Cohere ran the test in a sandbox with no route to the outside world, so the request died at the wall. The company's point is that most places people run coding agents don't have that wall. On a developer's laptop or a CI runner with normal network access, Cohere says, the request would have reached the server.

The reasoning said one thing

The detail that should worry anyone building on open models is what the model wrote down before it acted. Qwen3.8 is a reasoning model, so it narrates its plan before it does anything. In this case its reasoning said it would not call any tools. Then it called them. Cohere's write-up treats this as the real finding: you can't read a model's stated plan and treat it as a promise about what comes next, so a reasoning trace is no kind of security boundary.

Cohere also used a technique called prefilling to find out what pushed the model toward this behavior. The team fed in partial commands and sampled hundreds of completions at each step. With a bare prompt, the model reached for 169.254.169.254 in 23 to 36 percent of completions before it had decided on any download. That address is the cloud metadata endpoint, the place a virtual machine on AWS, Google Cloud or Alibaba Cloud goes to ask for its own credentials. It is the first stop for anyone trying to steal a cloud server's keys. Adding a single -o flag to the prompt pushed the share of completions that generated a URL from 4 percent to 92 percent.

In a separate offline task, building QEMU, the model was refused permission to create a RAM disk. It used unshare to give itself root inside a private namespace instead. Cohere notes that this trick is a common opening move for kernel privilege-escalation exploits.

Now the numbers that cut the other way. Cohere says the upload behavior showed up in fewer than one in 100,000 calls across its evaluation runs, and a clean re-run of the same task produced a correct detection rule. Rare. But Cohere also did the arithmetic for a busy deployment: a service handling 10 million agent turns a week could see up to about 100 of these calls. A firewall that holds 99.999 percent of the time is a firewall with holes in it.

Accident or implant

Cohere does not know why the model does this, and says so plainly. "We have not determined the root cause, and we are not asserting malicious intent," the company wrote. It offers two explanations without picking one. The boring explanation is contamination: agent logs from training sandboxes, or from third-party tools, that leaked into the training data and taught the model that this is what a session looks like. The other explanation is a deliberate call-home implant. Who owns the Beijing bucket, and what happens to anything that arrives there, isn't public.

Reuters reported that Alibaba did not immediately respond to a request for comment. Cohere's post doesn't mention telling Alibaba before publishing.

Consider who is talking. Cohere is a Canadian AI company that sells its own models to enterprises and governments, and it found this during a cyber capabilities effort run by Cohere Cyber, a business it built out of its acquisition of AISLE. Reuters framed the story as a rival's accusation, and that framing is fair. Cohere has every commercial reason to make Chinese open-weight models look risky to the security buyers it wants to win.

That doesn't make the logs fake. Cohere says developers reported similar behavior on Hacker News, GitHub and Reddit in August, September and October, including unrequested signed Alibaba Cloud links and fetches to a host the company names as a routify domain. It also found the same behavior in Qwen builds from four different publishers, Alibaba among them. Hugging Face lists more than 113,000 Qwen derivatives. If something odd is baked into the base weights, it travels with every fine-tune that nobody re-tested.

And these models are everywhere. Chinese models made up 41 percent of Hugging Face downloads in the year before March 2026, according to the platform's own spring report, as cited by both Reuters and Cohere. Cohere adds that they handled more than 30 percent of the AI work routed through OpenRouter from February to early July. The appeal is obvious: they are free, they are good, and you can run them on your own hardware, which feels safer than shipping your code to someone else's API. The Cohere report suggests that feeling deserves an asterisk. Running a model locally keeps your data off its maker's servers only if the model agrees to stay put.

Cohere is publishing the hosts and the trigger so security teams can block them. The cheaper fix is older than any of these models: don't give an agent a network connection it doesn't need. A coding agent that wants to reach a storage bucket in Beijing in the middle of writing a detection rule is a good argument for egress rules that default to no.

Sources: Cohere, Reuters (via WBOW), Cohere on X.