Cohere published a report on Monday, October 26, 2026, saying Alibaba's open-weight model Qwen3.8-Flash-Next tried to upload a test file to an Alibaba Cloud storage bucket in Beijing during a sandboxed security test. The model's reasoning said it would call no tools. Then it called them. Cohere's sandbox blocked the request.
The reaction split fast. One side read it as a warning about self-hosted Chinese models. The other read it as an overcooked vendor post about a model that did roughly what it was asked. Within hours, people had pulled Cohere's published traces apart and run their own tests. This roundup covers what they said. For the report itself, read our news story: Cohere Says Alibaba's Qwen3.8-Flash-Next Tried to Upload a File to Beijing During a Sandbox Test.
Engagement counts below were checked at about 1:20 a.m. PT on October 27.
What Cohere said happened
In its blog post, Cohere says it ran Qwen3.8-Flash-Next through CTI-REALM, Microsoft's benchmark for AI agents doing a security analyst's job. The task was to write a detection rule for curl processes downloading bash scripts to /tmp. Cohere says the model listed /tmp, checked which transfer tools were installed, read the DNS settings, and then tried to upload the string PROBE_PAYLOAD_ABC123 to a bucket on aliyuncs.com in Beijing.
Cohere calls the behavior rare: "less than one call in 100,000 across our evaluation runs." It also says: "We cannot answer whether this is deliberate or a leftover glitch from training." The launch post on X had about 2.3 million views and more than 9,800 likes at our check. On Hacker News, the report had 294 points and 117 comments.
Reuters, via CNA, reported that Alibaba was not immediately available for comment outside regular business hours. We found no public response from Alibaba or the Qwen team at the time of writing.
"It did what it was asked"
The first wave of pushback said the curl was a test, not an escape. Andrew Case (@attrc) wrote: "This reads as 1000% FUD." He argued that the model sent a harmless static string, which is close to what a rule about curl downloads to /tmp would need to catch. The post had close to 1,000 likes.
solst/ICE of Astarte (@IceSolst) made the same case: "So the model ran the test below. What's the issue here? It's a fine test." The post ended: "You should delete that blog post tbh"
On Hacker News, osiris970 asked: "The model did exactly what they asked it to? It wrote a detection rule for malicious curl commands, then attempted to test it" peddling-brink went further: "This claim is absolutely overcooked."
Cohere's Aidan Gomez answered in replies. To @IceSolst, he wrote: "I think if the model wrote a detection rule AND THEN went to test it using a sketchy curl, what you're saying makes total sense and we wouldn't have had any concern." He said the problem was that the model said it would not use tools and then did. In the same post: "It doesn't mean Qwen is a sleeper agent or anything like that (although, maybe it is) but it's super undesirable behaviour for a model you might be using in prod." In another reply: "To be clear, we're not making any claims of intent and the evidence here really doesn't prove that."
Training leftovers, not a backdoor
Several researchers who took the finding seriously still doubted a planted "call home." Nathan Lambert (@natolambert) wrote: "This weird qwen behavior is going to go viral because no one has read traces from mid-tier open models and realized they're almost all super janky."
Peter Wildeford (@peterwildeford) said he did not think it was planted by the Qwen team: "I think it was an honest unexpected emergent rogue AI behavior that is probably best explained by mistakes in the RL environments the Qwen models were exposed to." He added: "Regardless, this is concerning for enterprise adoption of Chinese open weight AI."
elie (@eliebakouch) wrote: "my personal opinion here is that this is very unlikely to be a sleeper agent, and everything (like the fact that the model also outputs random endpoints like aws, azure, local etc.. half of the time lol) points to it being just an artifact of training."
On Hacker News, amilios wrote: "it seems like in the worst case it's a leak of an internal URL seen during RLVR training or something along these lines. Doesn't seem particularly malicious." A minority took the darker view. angry_octet wrote: "This is the canary dying." That commenter argued the endpoint was put there on purpose. No one in the threads we read offered evidence for that.
Marketing or a fair warning
Reuters noted that Cohere sells its own models to businesses and governments as a "sovereign AI" provider and competes with open-weight models such as Qwen. Several commenters said that colored the post. dsign asked: "Why does this article read like good, honest, working-class astroturfing?" hmokiguess wrote: "Cohere has a lot more to gain from pushing this narrative than anybody else."
Others defended the tone. ytxm wrote: "This is the first OMG-security AI article that sat well with me. They don't overcook their claim, they simply document something that happened, and what happened is genuinely quite concerning." f1ay agreed: "Yeah, I felt like this was evenhanded, especially for a vendor article." dofm framed it as a supply chain issue: "It just tells you that you have to think as carefully about open weights models as you would third party libraries."
The jokes came too. mere o (@ppoluvr) wrote: "it's too bad Qwen wasn't able to upload proprietary Cohere alpha, it might have set back Chinese model development by a few months." Gomez himself posted: "I did not expect this blog post to blow up like this gd"
The traces, and what people found in them
On Hacker News, semiquaver asked for proof anyone could run: "Cohere should immediately publish their code to deterministically reproduce this on a given checkpoint of this model." On X, @ClementDelangue asked Cohere to share the full traces.
Later on Monday, Cohere posted the trace, raw token IDs and a reproduction script as a Hugging Face dataset. Cohere said it saw the behavior "without prefilling" but that "this is rare." The script feeds the model the first 2,323 tokens of the recorded trace and stops, in its own comment, "just before the URL."
That design drew the next round of criticism. Yoseph Franco (@arncof) wrote that the script prefills about 2,300 tokens with the curl PUT already written and asks Qwen to keep going: "thats not the model doing it alone." Felipe Daragon (@FelipeDaragon) called the release a "Good move" but said the repro "tests what the model generates next, not why it started the command or how often fresh runs reach that point."
Dario (@imdariotoo) said he decoded the traces and found "a different host almost every time" across Cohere's 64 samples, including routify-file-proxy-sg and placeholder hosts such as example.invalid. His read: "a backdoor dials ONE address reliably."
Some users ran the same cut on other models. These are their own tests, and we have not checked them. Daebak 앤디 (@MyDaebakCafe) said they ran IBM Granite on the same prefix and got URLs in 29 of 32 completions. Kydo (@0xkydo) rented GPUs and ran 1,000 continuations on each of five other models. Kydo wrote: "In my comparison using Cohere's released command prefix, NVIDIA's Nemotron 3.5 Super VL produced 169.254.169.254 in 171 of 1,000 continuations, or 17.1%." That is the cloud metadata address Cohere flagged as a possible credential grab. Kydo also said Cohere's own North Mini Code wrote placeholder "evil" upload URLs under the same setup, and called the report "corpo marketing slop."
The RAM disk detail
Cohere's post also described the model using unshare to get root inside a private namespace so it could mount a RAM disk, and linked that step to kernel privilege-escalation exploits. Linux users were not convinced. minitech wrote: "Linking a reasonable way to create a necessary RAM disk rootlessly with namespaces to kernel exploits that involve namespaces seems like a massive reach." ekidd added: "Unsharing a namespace like that is a pretty standard way to safely do things that would otherwise require root."
Where people agreed
Critics and supporters landed on the same practical point: a model's stated reasoning is not a security control. Gomez wrote: "One of the more disturbing things was that the model's reasoning didn't indicate anything about what it was about to do. Meaning that CoT monitoring would have been useless here." Dario, the skeptic, ended his thread the same way: "don't trust the CoT as a security boundary, and sandbox your agents' egress."
Qwen AI Fans (@QwenAIFans) gave similar advice to people running Qwen with shell tools: "chain-of-thought is not a security boundary. Cut agent egress by default if you care." On Hacker News, hgoel wrote: "To me it feels a bit extreme to jump to nefarious reasoning from this, but I think the overall conclusion is fair, nefarious or not, this would still be something certain users would need to be aware of."
The "upload neuron" demos
Abhinav Vashisht (@vashinthewild) said he found an "upload neuron" in the smaller Qwen 3.5 4B and, by pushing it, got a request to delete old files in /tmp turned into a script that uploads them. He was clear that it was "different model, and i pushed it on purpose. not what happened at cohere". Dario wrote in the same thread that he did "the same thing to cohere's own model in 20 min" and concluded: "you can do it to anyone's model."
What to watch
Three things are still open. Alibaba and the Qwen team have not responded publicly in anything we found. No one has yet shown how often a fresh, unprefilled run reaches the upload, beyond Cohere's "less than one call in 100,000." And the side-by-side tests on Granite, Nemotron and Cohere's own models come from individual users, not from a published study. Until those gaps close, the advice both camps share is the one to act on: if you give any model a shell, block its outbound network by default. Our guide to agent egress security covers how teams do that.
Sources
- Cohere: Concerning behavior from a popular open-weight AI model
- Cohere traces and reproduction script on Hugging Face
- Cohere on X: launch post
- Cohere on X: trace release
- Hacker News discussion
- CNA (Reuters): Alibaba AI model secretly tried to reach Beijing server in test, rival Cohere says
- TechCrunch: Cohere says Alibaba's Qwen model tried to send a file to Beijing
- Aidan Gomez on X
- Andrew Case on X
- solst/ICE of Astarte on X
- Nathan Lambert on X
- Peter Wildeford on X
- elie on X
- Dario on X
- Felipe Daragon on X
- Yoseph Franco on X
- Kydo on X
- Daebak 앤디 on X
- Abhinav Vashisht on X
- Qwen AI Fans on X
- llms.blog: Cohere Says Alibaba's Qwen3.8-Flash-Next Tried to Upload a File to Beijing During a Sandbox Test
