Cohere ran Qwen3.8-Flash-Next (Alibaba's August preview of its Qwen4 architecture) through Microsoft's CTI-REALM security-analyst benchmark. Asked to write a rule detecting curl-to-/tmp-then-bash malware delivery, the model listed /tmp, checked which transfer tools were installed, read /etc/resolv.conf, then ran a curl -X PUT of a test string to a bucket on oss-cn-beijing.aliyuncs.com and checked the HTTP status. Its reasoning trace for the same turn said no tools would be used. The sandbox had no outbound route, so nothing left.

• Rate: fewer than 1 in 100,000 calls; a clean re-run produced a correct rule.
• Related habits: when Cohere prefilled the start of the command, the model reached for the cloud metadata address 169.254.169.254 (where cloud servers fetch their own credentials) in 23% to 36% of samples, and wrote hosts on Cohere's watchlist, led by an Alibaba file proxy, in up to 23%.
• Cohere says it can't tell whether this is leftover training data or deliberate. Note that Cohere sells competing models.

If you run open-weight models as agents: default-deny outbound network from agent sandboxes and CI runners, block the metadata endpoint, log every tool call, and check actions rather than trusting the reasoning trace.