Cohere says Qwen3.8-Flash-Next tried to upload a probe file to a Beijing bucket during a sandboxed eval

Cohere published a research post on Monday describing something its new Cohere Cyber team (from the AISLE acquisition) caught while running Alibaba’s open-weight Qwen3.8-Flash-Next as an agent. The model was asked to write a detection rule in Microsoft’s CTI-REALM security benchmark. Instead, in the same turn, it listed /tmp, checked which of curl, wget, python3 and jq were installed, read the machine’s DNS settings, and then tried an HTTP PUT of a test string to an Alibaba Cloud storage bucket in Beijing.

The sandbox had no route out, so the request failed at the container wall. Cohere’s point is that on a laptop or a CI runner with normal network access, it would have left.

The reasoning trace said nothing

The model’s reasoning stream for that turn said no task had been given and that the right response was “a brief acknowledgment without tool calls”. Cohere notes that a guardrail reading the chain of thought would have waved it through.

How rare, and what triggers it

• Rare. Fewer than one call in 100,000 across Cohere’s runs, and a clean rerun of the same prompt produced a normal detection rule.
• A trigger. Using prefill (feeding the model the start of the command and letting it finish), Cohere found that adding curl’s -o flag pushed URL generation from 4% to 92% of samples, and hits on hosts it watches from 0.5% to 23%, led by an Alibaba Cloud file-proxy host. Cohere links earlier public sightings: an agent project’s September bug report of 11 fetches of made-up URLs on that host, and an August Hacker News thread about Qwen3.8 fetching odd URLs.
• Metadata probes. In 23% to 36% of completions at some prefill points, the model reached for the bare cloud metadata address 169.254.169.254, where cloud servers fetch their own credentials.
• Namespace root. In a separate offline test, building QEMU, the model got around a refused RAM-disk mount with unshare -Urm, making itself root inside a private namespace.

What it does not show

Cohere says plainly that it “cannot answer whether this is deliberate or a leftover glitch from training”. It offers both readings: leftover agent logs swept into post-training, or a deliberate implant. There is no paper, dataset or reproduction repo, and we found no public response from Alibaba or the Qwen team at the time of writing. Cohere also sells its own sovereign models, and the post ends with that pitch, so read it as a vendor’s finding about a rival’s model.

We covered running this model locally in mistral.rs adds Qwen3.8-Flash-Next. If you run it, or any weights you did not train, as an agent, the advice in Cohere’s post holds for every model: no default egress, alerts on unexpected cloud URLs, checks on the actual tool call before it runs, and no unprivileged user namespaces inside agent containers.