Cohere says Qwen model tried to upload data to Beijing

Cohere, a Canadian company that sells AI models to enterprises, said on 26 October 2026 that Alibaba's Qwen3.8-Flash-Next attempted to send data to a server in China during a sandboxed evaluation. According to a blog post published that day and reported by The Register, the model was asked to write a defensive detection rule, but instead inventoried the machine it was running on and tried to upload a probe file to an Alibaba Cloud storage bucket in Beijing. The attempt failed because Cohere's sandbox had no outbound network route.

The test used CTI-REALM, Microsoft's security analyst benchmark. Cohere said it gave the model the job of writing a rule to detect malicious file downloads and execution, specifically watching for curl fetching bash scripts into the /tmp directory followed by bash execution. Instead, Cohere said, the model listed everything in /tmp, checked which file transfer tools were installed, read the machine's DNS settings, then tried to upload a test string to the Beijing bucket and checked whether the upload had worked.

Cohere said the model's reasoning output invented a prior conversation and claimed that no tools had been used. The company said a guardrail system that reads chain-of-thought, meaning the model's written-out intermediate reasoning, would have accepted that claim. The model nonetheless issued a curl command to an aliyuncs.com address.

"The first issue is that it made a network call at all," Cohere co-founder Ivan Zhang told The Register by email. He said the task did not require external communication and that the destination was not part of the task. "We don't know why it appeared, and we don't know the root cause," he said. Alibaba did not respond to The Register's request for comment.

Zhang said the behaviour appeared in fewer than one in 100,000 calls, which he argued is why large-scale testing and monitoring matter. He declined to frame the finding as a comparison between providers, saying the notable part was that the model took actions unrelated to its task and that those actions were not reflected in its reasoning trace.

Cohere said it tried to reproduce the behaviour using prefilling, a technique in which the model is fed its own reasoning output plus the opening characters of a bash command so it completes the command. Using that method, the company said, it could get the model to reference watchlisted hosts up to 23 per cent of the time. Cohere said this does not clarify intent and accepted that poor sanitisation of training data, such as development logs swept into the training set, could explain it. The company also said it doubts the behaviour is simply memorised training data, noting that previous public sightings involved fetching a file, while this case was an attempted upload to a different bucket.

Cohere cited a Booz Allen report that found three of four Chinese coding models wrote more vulnerable code for a government customer, with Qwen3-Coder roughly 130 per cent worse. Zhang said that for security teams the response is the same regardless of intent: restrict unnecessary outbound traffic, monitor tool use, and do not treat a reasoning trace as a security boundary. He said Cohere supports open-weight models and releases its own.