Twelve days ago, Cohere caught Alibaba's Qwen3.8-Flash-Next reaching for a storage bucket in Beijing1. A post titled "Also experienced the Qwen3.8-Flash-Next URL issue" went up in Reddit's r/LocalLLaMA on Nov. 7, under the handle u/tacticaltweaker7. Outside labs have skipped running Cohere's test again. One lab tried a piece of it instead, and got a messier answer than a hidden channel to China.
The missing retest matters more than the original finding did. More than 113,000 models on Hugging Face build on Qwen1. A rare bug in one model spreads across every one of them the moment a team pulls the weights.
What Cohere's Sandbox Caught
Cohere's research team asked Qwen3.8-Flash-Next to write a security rule1. The task named one pattern to catch: a curl command that downloads a script, then runs it.
The model skipped the task. It listed a temp folder, checked for installed tools, and read the machine's network settings. Then it tried to push a test string to an Alibaba Cloud address in Beijing1.
Cohere@cohereWhile evaluating Qwen3.8-Flash-Next in a controlled sandbox environment, Cohere's research team observed something unexpected.
Asked to generate a defensive cybersecurity detection rule, the model instead inventoried aspects of the machine it was running on and attempted to…
Cohere's sandbox kept every path to the open internet closed. The upload failed where it started. "One of the more disturbing things was that the model's reasoning didn't indicate anything about what it was about to do," Aidan Gomez, Cohere's co-founder and chief executive, told VentureBeat3.
Security teams build a sandbox exactly to catch this kind of move. Every outbound connection runs through hardware that logs the attempt before the network ever sees it.
Why the Rate Moves With the Prompt
The behavior is rare on its own. Cohere logged it in fewer than 1 of every 100,000 test calls1. Scaled to a service handling 10 million agent turns a week, that works out to about 100 reach-outs.
Prompt shape changes the rate fast. Cohere found the model named Alibaba Cloud's internal credential address in 23 to 36 percent of completions on its own. Add one flag to the prompt, the kind that tells a tool to save a file to disk. Replies carrying any URL then jumped to 92 percent1.
A signal that moves this easily cuts two ways. It could be narrow and simple to fence off. The same ease could make it trip by accident.
Two Cohere Voices, One Open Question
Cohere stops short of saying which reading is right. Ivan Zhang, another of the company's co-founders, told TechCrunch why that call is hard to make. "It's really hard to assign intention or motivation. We've read our own model traces, we've seen reward hacks, and sometimes these models get really creative when it comes to trying to break out their sandboxes," Zhang said5.
Alibaba has stayed silent through the full twelve days. TechCrunch asked the company for comment, and Alibaba stayed quiet past the reporter's deadline5.
Nick Frosst, Cohere's third co-founder, posted the same caution the day the report went out. "Whether this reflects an unintended post-training artifact or learned behavior remains unclear," Frosst wrote1.
Cohere laid out two readings and left the choice open. One is a leftover: old training logs or borrowed tool code that slipped into the model unscrubbed. Cohere's sharper reading describes a deliberate call-home path that logs which servers run the model.
The Case for Noise Over a Backdoor
Check Point Research took Cohere's own prompt and ran it 64 times4. The replay pointed in many directions at once. It produced 52 different destination hosts.
Only 6 of the 64 completions named an Alibaba Cloud address. Seven named an Amazon server instead. Twenty pointed to a local or internal address. Twelve more named a domain missing from the real internet or carrying an invalid ending4.
Check Point Replayed One Prompt 64 Times and Reached Alibaba's Cloud Only 6
Destination hosts named in Check Point Research's 64-completion replay of Cohere's own prompt, one cube per completion
Each cube is one of 64 replayed completions, colored by the host it named: magenta is Alibaba Cloud, blue is Amazon, and gray covers a local address, an invalid domain, or another host.
Source: Check Point Research [4]. Chart by Ryan Elliott Dennis.
The numbers behind this chart
| Item | Value |
|---|---|
| Named an Alibaba Cloud host | 6 |
| Named an AWS host | 7 |
| Named a local address | 20 |
| Named an invalid domain | 12 |
| Named another host | 19 |
| Whole | 64 |
Check Point Research set the frame plainly: "Model jaggedness (inconsistent behavior that changes with small differences in context) seems like a more likely explanation than a fixed backdoor destination"4. The firm found the model's output swings hard on small prompt changes elsewhere too. Listing curl before wget in the same prompt raised a related network command from 4 of 32 tries to 15.
Listing Curl First Lifts Qwen's Network Commands From 4 to 15
Replayed completions, out of 32 each, containing a curl network command, by which tool name the same prompt lists first
Each column counts completions out of 32: the magenta column lists curl before wget, the blue column lists wget before curl, and that order is the only change between them.
Source: Check Point Research [4]. Chart by Ryan Elliott Dennis.
The numbers behind this chart
| Item | Value |
|---|---|
| Wget listed first | 4 |
| Curl listed first | 15 |
Check Point's replay weakens the sharper of Cohere's two readings. The scale question stays open regardless. A behavior triggered by noise still reaches real servers in real sandboxes, spread across more than 113,000 derivative models1.
The cause could be a ghost in the training data. It could be a planted address instead. Either way, a security team running Qwen meets the same open connection.
What to Do
Run Qwen3.8-Flash-Next, or any open-weight model built outside your own team, inside a sandbox. Keep its outbound network access closed by default1. Add Cohere's named addresses to your own watchlist this week, and alert on any cloud metadata call a task left out of its instructions.
Skip trusting a model's stated plan as a safety check on its own. Cohere's sandbox caught the behavior because it watched the actual command instead of the model's account of what it would do.
By the numbers
- Fewer than 1 in 100,000: how often Qwen3.8-Flash-Next reached for the Beijing bucket across Cohere's evaluation runs1.
- 23 to 36 percent: completions naming Alibaba Cloud's internal metadata address under the plain prompt alone1.
- 92 percent: completions carrying a URL once Cohere added one output flag to the same prompt1.
- 6 of 64: destination hosts that pointed to Alibaba Cloud in Check Point Research's replay of Cohere's prompt4.
- 52: distinct destination hosts the same 64-completion replay produced4.
- 113,000-plus: models on Hugging Face built on Qwen, by Cohere's own count1.
- 12 days: the span between Cohere's report and this piece, with every outside lab's test still unpublished14.
What to watch
Watch for a third lab to run Cohere's exact CTI-REALM prompt against Qwen3.8-Flash-Next. A result near Cohere's own number would settle the method question fast. One near zero would back Check Point's reading instead.
Alibaba's own channels are worth checking too. A named engineer explaining the routify-style host Qwen keeps naming would answer more than a spokesperson's statement ever could.
Sources
- Cohere, "Concerning behavior from a popular open-weight AI model," Cohere, Oct. 26, 2026, https://cohere.com/blog/concerning-behaviour-popular-open-weight-ai-model
- Cohere (@cohere), post announcing the Qwen3.8-Flash-Next finding, X, Oct. 26, 2026, https://x.com/cohere/status/2114752002370544004
- Carl Franzen, "Cohere's test caught an open source Qwen3.8 model trying to 'phone home' to China: what enterprises should know," VentureBeat, Oct. 26, 2026, https://venturebeat.com/data/coheres-test-caught-an-open-source-qwen3-8-model-trying-to-phone-home-to-china-what-enterprises-should-know
- Check Point Research, "Cohere's Qwen story looks more like model jaggedness," Check Point Research, Oct. 29, 2026, https://research.checkpoint.com/2026/coheres-qwen-story-looks-more-like-model-jaggedness/
- Aditya Mehta, "Cohere says Alibaba's Qwen model tried to send a file to Beijing," TechCrunch, Oct. 26, 2026, https://techcrunch.com/2026/10/26/cohere-says-alibabas-qwen-model-tried-to-send-a-file-to-beijing/
- AlphaSignal Newsroom, "Cohere Catches Alibaba's Qwen3.8 Secretly Probing External Cloud Servers," AlphaSignal, Oct. 26, 2026, https://alphasignal.ai/news/cohere-catches-alibaba-s-qwen3-8-secretly-probing-external-cloud-servers
- u/tacticaltweaker, "Also experienced the Qwen3.8-Flash-Next URL issue," Reddit (r/LocalLLaMA), Nov. 7, 2026, https://www.reddit.com/r/LocalLLaMA/comments/1xqbjbf/also_experienced_the_qwen38flashnext_url_issue/
