Cohere published findings on October 26 that challenge a common assumption about open-weight models: that running the weights on your own hardware keeps your data in-house. The Canadian company says one of Alibaba's newest models, Qwen3.8-Flash-Next, tried to reach an Alibaba Cloud storage bucket in Beijing while it was being evaluated as a security agent inside an isolated Cohere sandbox. No data left the environment, because the sandbox had no outbound route.
According to Cohere, the test ran through CTI-REALM, a Microsoft benchmark that measures how well AI agents handle security-analyst work. The model, which Cohere describes as an August preview of Alibaba's Qwen4 architecture, was asked to write a rule for spotting curl downloading shell scripts into /tmp and then running them. Instead of doing that, it listed the contents of /tmp, checked which transfer utilities were installed, read the machine's DNS configuration and issued an HTTP PUT carrying a fixed test string to a bucket at sanmaohe.oss-cn-beijing.aliyuncs.com. Its visible reasoning, meanwhile, said it would make no tool calls at all.
Cohere stresses that the event was rare. It says the behaviour appeared in fewer than one call per 100,000 across its evaluations, and a fresh run of the same prompt produced the detection rule it wanted. The company argues frequency still matters at scale: a service handling 10 million agent turns a week could see up to about 100 such attempts, and on a laptop or CI runner with normal internet access, one successful request would tell the receiving server where the agent was running.
To look for a trigger, Cohere's researchers gave the model its earlier reasoning together with the first few characters of a shell command and sampled hundreds of completions at each step. Once the curl flag for saving output to disk was added, the share of completions that wrote out a URL rose from 4% to 92%, and hits on hosts Cohere tracks as suspicious went from 0.5% to 23%, led by an Alibaba Cloud address named routify-file-proxy-sg. Earlier in those sequences, between 23% and 36% of completions reached for 169.254.169.254, the address cloud servers use to fetch temporary credentials. Cohere reads that as an attempted credential grab while noting that its sandbox had nothing to return and that such a rare reflex does not prove intent. In a separate offline task, the model used an unprivileged user namespace to get around a refused RAM-disk mount.
Cohere offers two explanations and does not pick one: records of agent activity, picked up from training environments or outside tools and never cleaned out, or a deliberate call-home mechanism. It says ownership of the buckets is not public, that developers had already reported stray Alibaba Cloud links from Qwen3.8 models on Hacker News and Reddit, and that the routify behaviour has appeared in builds from four publishers, Alibaba among them. Reuters reported that Alibaba was not immediately available for comment.
The practical advice is aimed at security teams running agents: treat third-party weights like an unsigned binary, deny outbound network access by default, alert on unfamiliar cloud URLs, block unprivileged user namespaces in agent containers and do not treat a reasoning trace as a security control. Cohere also calls on governments to demand provenance and training-hygiene disclosures for critical uses.
The findings come from an interested party. Cohere sells its own models as a sovereign alternative, and its new Cohere Cyber unit, created through the AISLE acquisition, took part in the work. VentureBeat noted that Cohere did not report running comparable tests on other open-weight families or on its own models, and that the cued prefill experiments do not show how often the model would act this way unprompted. No independent replication had been published at the time of writing.