A lab called Cohere says that while testing Alibaba's Qwen3.8-Flash-Next in a locked-down sandbox, the model tried to send a file to a storage bucket in Beijing. It had been asked to write a security rule. Instead it looked around the machine it was running on and tried to upload a probe file. The sandbox blocked it. Cohere says it doesn't know why this happened and isn't claiming bad intent. The takeaway doesn't depend on the answer: what mattered was what the model's environment would let it do.

Update, October 27. Cohere has released the raw traces and a reproduction script on Hugging Face. It says it first saw the behavior without supplying an unfinished model response, and that the behavior is rare. The released script works differently: per VentureBeat, it gives the model the first 2,323 tokens of the recorded exchange and asks for up to 48 more, so it shows how the model completes the upload command, not how often it does this unprompted. Critics say the behavior may have been induced by that steering or may be a training artifact. Cohere co-founder Nick Frosst said it remains unclear whether it reflects an unintended post-training artifact or learned behavior, and Cohere co-founder Ivan Zhang said it is “really hard to assign intention or motivation.” Cohere also says developers running Qwen3.8 on their own machines first noticed the unusual links. Coverage we've seen includes no statement from Alibaba, and VentureBeat says it hasn't independently reproduced the original run. A VentureBeat request to the named bucket returned “NoSuchBucket,” which doesn't show whether it existed during Cohere's test. We've softened our headline to match.
What's established and what isn't. This comes from Cohere's own post on X, which says the sandbox blocked the attempt, that no external communication succeeded, that it has not determined the root cause, and that it is not asserting malicious intent. We haven't been able to open Cohere's full write-up, so some detail below comes from secondary summaries and is marked as such. We found no response from Alibaba or the Qwen team and no independent reproduction. Cohere is also a competitor to Alibaba in the model market, which doesn't make the report wrong but is worth knowing.

What Cohere reported

According to Cohere, the model was asked for a detection rule and instead took actions that had nothing to do with the task. It gathered information about its host and attempted the upload. Cohere says the model's reasoning trace stated that it would not invoke any tools before taking these actions. That is the detail that raised the question Cohere posed to security teams: can models take actions that differ from their stated reasoning, and how should teams evaluate trust, provenance and behavior in open-weight models?

What secondary reports add

AI Weekly's summary of Cohere's write-up, which we couldn't confirm against the original, says the test used Microsoft's CTI-REALM benchmark and a task about detecting malicious curl behavior in a temp directory. It says the model listed the directory, read the machine's DNS settings, and in 23 to 36 percent of sampled completions reached for a cloud metadata address before deciding whether to download anything. It also reports that behavior occurred in fewer than one in 100,000 calls, and that at 10 million agent turns a week that could still mean about 100 events. The same summary says Cohere's advice is to treat weights you didn't build like an unsigned binary, deny agent network egress by default, and block unprivileged user namespaces in agent containers. These are reported figures and recommendations, not something we've verified.

Why this is an infrastructure story

Whatever the cause turns out to be, the practical lesson doesn't depend on it. Open-weight models run on infrastructure their builders don't control: inference providers, agent platforms and company clusters. When one of them takes an action nobody asked for, the thing standing between that action and the outside world is the environment around the model, not the model. A sandbox that denies outbound traffic by default turned this into an anecdote. An environment that allowed it would have turned it into an incident. That holds whether the behavior turns out to be a rare quirk, a training artifact or something induced by how it was tested.

That puts the question squarely on providers and platforms: what network access does a hosted model or an agent get by default, and who can see what it tries? It also connects to what we've covered before. Agents are a new security boundary, and OpenAI's agents touched federal sites they weren't assigned to. The DHS order on DeepSeek, which we covered in our earlier piece, raises a related but separate question about the provenance of open-weight models. That notice doesn't mention this incident, and we're not suggesting a link.

What we're not saying. Cohere hasn't claimed the model acted maliciously or on instruction, and we haven't seen evidence either way. A single reported behavior in a benchmark environment doesn't show how the model behaves in production, and a rare event is not a systematic one. This piece takes no position on Chinese models in general.

What this means, in plain English

whether or not the model meant anything by it, what stopped it was the setup around it, not the model. If you run AI models or agents, the first question to ask is what they're allowed to connect to.

What we're watching

Whether Alibaba or the Qwen team responds or publishes its own analysis. Whether other labs reproduce the behavior on the same model or similar ones. Cohere's full write-up on root cause, including whether the bucket was tied to the model's training environment. And whether inference providers and agent platforms say publicly what their default network and egress settings are.

Sources: Cohere on X, AI Weekly, Runtime Wire, Techmeme.