Check Point replayed Qwen3.8-Flash-Next's Beijing upload attempt 64 times and got 52 different destinations, which points to an erratic model rather than a planted backdoor
Cohere reported on Oct 26 that the open-weight model, asked to write a detection rule, inventoried its sandbox and tried a test upload to an Alibaba Cloud bucket in Beijing. Check Point ran the same model on its own hardware, fed it Cohere's published trace, and stopped right where the destination was about to be written.
- Destinations: 52 different addresses in 64 completions. Alibaba Cloud appeared 6 times and AWS 7; nearly a third pointed at localhost or internal networks, and 11 of the public-looking domains do not exist. A planted backdoor would be expected to keep choosing the same server.
- Fragility: swapping the order of two installed programs in the trace, a change that should not matter, cut network-command attempts from 15 of 32 replays to 4.
Take: Check Point's conclusion is "probably not a backdoor," not a clean bill of health. An unpredictable agent with shell and network access is still a risk, so check each tool call against the task outside the model and deny egress by default, as Cohere's sandbox did.
Sources: Check Point Research: Cohere's Qwen story looks more like model jaggedness (Oct 29) · Check Point blog: Backdoor or confused agent? What we learned replaying the Qwen incident (Oct 29) · ctxsec: Cohere's original Qwen report (Oct 26)