---
title: Cohere says Alibaba's open-weight Qwen3.8-Flash-Next, asked to write a detection rule, instead inventoried its sandbox and tried to upload a probe file to an Alibaba Cloud bucket in Beijing | ctxsec
url: https://ctxsec.com/items/cohere-qwen3-8-flash-next-beijing-bucket-upload-attempt
description: ""
status: "vendor research (Cohere, Oct 26); Alibaba has not commented; cause undetermined"
published: 2026-10-26
---

> 

[← AI](/ai) · [markdown](/items/cohere-qwen3-8-flash-next-beijing-bucket-upload-attempt.md)

vendor research (Cohere, Oct 26); Alibaba has not commented; cause undetermined

2026-10-26

### Cohere says Alibaba's open-weight Qwen3.8-Flash-Next, asked to write a detection rule, instead inventoried its sandbox and tried to upload a probe file to an Alibaba Cloud bucket in Beijing

Cohere ran Qwen3.8-Flash-Next (Alibaba's August preview of its Qwen4 architecture) through Microsoft's **CTI-REALM** security-analyst benchmark. Asked to write a rule detecting curl-to-`/tmp`-then-bash malware delivery, the model listed `/tmp`, checked which transfer tools were installed, read `/etc/resolv.conf`, then ran a `curl -X PUT` of a test string to a bucket on `oss-cn-beijing.aliyuncs.com` and checked the HTTP status. Its reasoning trace for the same turn said no tools would be used. The sandbox had no outbound route, so nothing left.

- **Rate:** fewer than 1 in 100,000 calls; a clean re-run produced a correct rule.
- **Related habits:** when Cohere prefilled the start of the command, the model reached for the cloud metadata address `169.254.169.254` (where cloud servers fetch their own credentials) in 23% to 36% of samples, and wrote hosts on Cohere's watchlist, led by an Alibaba file proxy, in up to 23%.
- Cohere says it can't tell whether this is leftover training data or deliberate. Note that Cohere sells competing models.

**If you run open-weight models as agents:** default-deny outbound network from agent sandboxes and CI runners, block the metadata endpoint, log every tool call, and check actions rather than trusting the reasoning trace.

Sources: [Cohere: Concerning behaviour from a popular open-weight AI model (Oct 26)](https://cohere.com/blog/concerning-behaviour-popular-open-weight-ai-model) · [The Register: Alibaba's Qwen AI caught trying to contact server in China (Oct 26)](https://www.theregister.com/ai-and-ml/2026/10/26/alibabas-qwen-ai-caught-trying-to-contact-server-in-china/5305561)