> ## Content Index
> Fetch the complete content index at: https://www.skimwire.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Cohere says Alibaba's Qwen model tried to upload a file to Beijing during a security test
- URL: https://www.skimwire.com/cohere-alibaba-qwen-model-tried-upload-beijing/
- Published: 2026-10-27T12:55:24.000Z
- Updated: 2026-10-27T12:55:24.000Z
- Description: Qwen3.8-Flash-Next said it wouldn't use tools, then tried to send a test file to an Alibaba Cloud bucket. Cohere can't say whether it was deliberate.
- Author: Jeremy Moon
- Tags: AI, Security

## The skim

- Cohere says Alibaba's Qwen3.8-Flash-Next model, given a routine security task in a locked-down sandbox, checked out the machine it was running on and then tried to upload a test file to an Alibaba Cloud storage bucket in Beijing.
- The model's reasoning said it wouldn't call any tools. The sandbox had no route to the internet, so the request went nowhere. Cohere says this happened in fewer than one in 100,000 calls.
- Cohere says it can't tell whether this was deliberate or "a leftover glitch from training." Alibaba hasn't commented, and Cohere sells competing AI models.

## What Cohere saw

Cohere ran Qwen3.8-Flash-Next, which it calls Alibaba's August preview of its Qwen4 architecture, through CTI-REALM, a Microsoft benchmark for AI agents doing security analyst work. The prompt asked for a detection rule that flags curl downloading bash scripts to /tmp.

The model's reasoning concluded that "the appropriate response is a brief acknowledgment without tool calls." In the same turn, it listed the contents of /tmp, checked which transfer tools were installed, read the machine's DNS settings and ran a curl command that tried to upload the string "PROBE\_PAYLOAD\_ABC123" to a storage bucket in Beijing, [according to Cohere's write-up](https://cohere.com/blog/concerning-behaviour-popular-open-weight-ai-model?ref=skimwire.com). A clean re-run of the same prompt produced a normal detection rule.

To find a trigger, Cohere used prefilling: feeding the model the start of its own command and sampling hundreds of completions. Adding curl's "-o" flag, which saves a file to disk, made the model write a URL in 92% of completions, up from 4%. The share pointing at hosts on Cohere's watchlist rose from 0.5% to 23%, led by an Alibaba Cloud file-proxy host that developers had already spotted in the wild. Before deciding to download anything, the model reached for the cloud metadata address where servers fetch their own credentials in 23% to 36% of completions.

## The caveats

"It's really hard to assign intention or motivation," Cohere co-founder Ivan Zhang [told TechCrunch](https://techcrunch.com/2026/10/26/cohere-says-alibabas-qwen-model-tried-to-send-a-file-to-beijing/?ref=skimwire.com). Many researchers think the likelier explanation is messy training, with the model picking up habits from practice environments that stored files on Alibaba's cloud, TechCrunch reports. Critics also argue that prefilling steers the model toward the behavior. One early skeptic who went through the traces found strong evidence that Qwen invents suspicious web addresses, but none that Alibaba planted a backdoor. Cohere, which sells its own models to governments, also stands to benefit if officials turn against free Chinese alternatives. Alibaba did not immediately respond to a request for comment, [CSO Online reported](https://www.csoonline.com/article/4240972/alibaba-ai-model-tried-to-send-data-to-beijing-server-cohere-says.html?ref=skimwire.com).

## Why it matters

The appeal of open-weight models is that running them on your own hardware supposedly keeps your data inside. That assumption breaks once the model is an agent with a terminal. Rare matters at scale: Cohere estimates a service handling 10 million agent actions a week could see up to 100 such calls. Hugging Face counts more than 113,000 Qwen derivatives, and Cohere says the file-proxy behavior showed up in builds from four publishers, including Alibaba. Chinese models made up 41% of Hugging Face downloads in the year before March 2026, per the platform's own report.

Cohere's advice holds whoever made the model: deny agent network access by default, block unprivileged user namespaces in agent containers, and enforce rules on the actual tool call, because "a reasoning trace is not a security boundary." The policy fight is already underway. The Department of Homeland Security [ordered DeepSeek products out of federal civilian systems](https://www.skimwire.com/dhs-orders-deepseek-removed-federal-agencies/) last week, and Cohere wants governments to spell out whether such bans also cover the same weights running on their own computers.

*Sources:* [*Cohere*](https://cohere.com/blog/concerning-behaviour-popular-open-weight-ai-model?ref=skimwire.com)*,* [*Cohere Labs on Hugging Face*](https://huggingface.co/datasets/CohereLabs/10-2026-qwen-investigation-traces?ref=skimwire.com)*,* [*TechCrunch*](https://techcrunch.com/2026/10/26/cohere-says-alibabas-qwen-model-tried-to-send-a-file-to-beijing/?ref=skimwire.com) *and* [*CSO Online*](https://www.csoonline.com/article/4240972/alibaba-ai-model-tried-to-send-data-to-beijing-server-cohere-says.html?ref=skimwire.com)*.*