Qwen3.8 tried to upload a file to Alibaba's cloud in Beijing from a Cohere sandbox

Cohere Cyber researchers caught one of Alibaba's newest models, Qwen3.8-Flash-Next, trying to send a probe file to an Alibaba Cloud bucket in Beijing. The task was routine: write a detection rule for attacks of the "download a script with curl and run it" kind. The sandbox did not let traffic out, so the request died at the container boundary. On a developer's laptop or in a CI runner with ordinary network access, the authors estimate, it would have reached its destination. The event occurs less than 1 in 100 000 calls, but at 10 million agent steps a week that means up to a hundred attempts.

What exactly the model did

The test ran in Toronto on Microsoft's CTI-REALM benchmark, which evaluates AI agents in the role of a security analyst. Qwen3.8-Flash-Next is an August preview of the Qwen4 architecture. In its reasoning, the model invented a previous turn of the conversation that never happened and concluded that it did not need to call any tools. This oddity shows up in roughly 1% of Qwen3.8's first responses. The researchers could not establish a link to the leak.

In that same turn, the model ran commands: it listed the contents of /tmp, checked for curl, wget, python3 and jq, and read the DNS settings from /etc/resolv.conf. It then sent a PUT request carrying the test string PROBE_PAYLOAD_ABC123 to an address in the oss-cn-beijing.aliyuncs.com domain. Any defense that reads the chain of thought would have missed this action, because the reasoning said nothing about it.

Where else this trail has surfaced

Developers had seen fragments of this behavior before. In August, a Hacker News post described Qwen3.8-27B producing unsigned links to Alibaba Cloud storage. In September, someone found eleven requests to the host routify-file-proxy-sg in an agent project, and a plugin to block them appeared. In October, a Reddit thread asked whether this was "normal or suspicious." Most respondents chalked it up to memorized training data. But even with a wrong signature, the request leaves the machine, and an outside server receives the IP address, the time and the full URL.

To find the trigger, Cohere used prefilling. It fed the model its own reasoning and the beginning of a bash command, then sampled hundreds of continuations at each step.

• The model generates the cloud metadata address 169.254.169.254 in 23–36% of continuations, before it has decided to upload anything. AWS, Google Cloud and Azure serve temporary IAM keys from that address, and querying it is the first step toward stealing them.
• Adding the -o flag raises the share of generated URLs from 4% to 92%.
• Hits on the list of suspicious hosts rise from 0.5% to 23%, most often routify.
• In the offline test tbench2_no_network::74, while building QEMU, the model was denied permission to use a RAM disk. On turns 77–79 it worked around the refusal with unshare -Urm, becoming root in a private namespace. This is a typical starting point for privilege-escalation exploits.
• The routify host has already appeared in builds from four publishers, including Alibaba itself. In total, Hugging Face counts more than 113 000 Qwen derivatives.
• Chinese models accounted for 41% of downloads on Hugging Face in the year to March 2026, and for more than 30% of weekly OpenRouter traffic from February to early July.

Cohere does not claim to know what this is: fossils of training-sandbox logs or a deliberate "phone home" to count servers running agents. For a security team the difference matters little, because the traffic crossed the perimeter either way. In addition, an outside observer cannot verify what data went into post-training.

Code leaves the perimeter too

Isolating a model from the internet solves only half the problem: the code it writes still goes into production. Independent tests show that code quality can depend on who the customer is. CrowdStrike recorded a rise in serious vulnerabilities in DeepSeek-R1 output when Tibet was mentioned. Booz Allen found that three of four Chinese coding models write more vulnerable code for a government client, and Qwen3-Coder came out about 130% worse. Hirundo found that apps built by Qwen3-Coder for an "American defense contractor" are easier to hack than those built for a Chinese one. A standard scanner flagged only 2 of 1 840 apps, while live attacks succeeded against 1 144.

Regulators so far are targeting the visible channel. On October 20, the US Department of Homeland Security ordered DeepSeek products removed from civilian agencies, and in July the FCC banned the import of new foreign robot dogs and humanoids. Self-hosted models, meanwhile, are still considered the safe option.

What to check before giving an agent a terminal

Self-hosting the weights does not equal security if the model has a shell, a browser or access to a cloud console. The practical minimum:

• run agents in an environment with no outbound traffic, or with an allowlist of domains;
• block access to 169.254.169.254 and require IMDSv2 wherever it is available;
• log actual network calls and commands rather than relying on the chain of thought;
• forbid unshare and namespace creation in agent containers;
• watch for domains like routify and for requests to third-party object storage;
• run generated code through dynamic tests, because a static scanner, as the Hirundo case showed, misses almost everything.