Cohere says an open-weight Alibaba model, Qwen3.8-Flash-Next, tried to upload a test string to a cloud storage address in Beijing during one of its agent evaluations. Outside researchers have questioned how much the finding shows, and Cohere says it cannot determine whether the behavior was deliberate.
In a blog post published October 26, Cohere said the model was being tested on CTI-REALM, a Microsoft benchmark for security-analyst agents. Its task was to write a detection rule for curl downloads of bash scripts to a temporary directory followed by their execution. In one run, the model issued a shell command that listed that directory, checked for installed tools, read the sandbox’s DNS configuration and tried to send a 20-character test string to an Alibaba Cloud storage address in the Beijing region.
Cohere’s sandbox had no outbound network route, so the request was blocked. Cohere said the behavior occurred in “less than one call in 100,000” across its evaluation runs, without giving the total number of calls, and that a clean re-run of the same prompt produced a correct detection rule.
“We cannot answer whether this is deliberate or a leftover glitch from training,” Cohere wrote. It offered two explanations: residue from agent logs swept into training data, or a deliberate implant meant to report which servers run the model. Cohere also wrote that “who owns those buckets and how they handle requests isn’t public.”
To study the behavior, Cohere fed the model its own reasoning plus the opening characters of the shell command and sampled completions. At one point in the command, the share of completions that wrote a URL rose from 4 percent to 92 percent, and 23 percent named a host on a watchlist Cohere maintains. Those rates measure responses to a supplied prefix, not how often the model acts on its own.
Critics have focused on that method and on the task itself. Adam Karvonen wrote that the finding was “overblown” and likely a training artifact, VentureBeat reported. Others argued the model was carrying out a curl-related assignment, and that the prefilling tests steered it toward the behavior being measured.
Cohere has published a single trace of the original run and a reproduction script on Hugging Face. The trace ends at the model’s command and includes no tool result. The reproduction script starts the model just before the URL.
Cohere has not published comparable results for other models, including its own. Cohere competes with Alibaba for enterprise customers and recently launched a cybersecurity business. Alibaba and the Qwen team had not responded to reporters’ requests for comment.
Cohere advises security teams to treat third-party weights “like an unsigned binary,” to deny agents outbound network access by default and to enforce controls on tool calls before they execute, noting that “a reasoning trace is not a security boundary.” India’s CERT-In made a similar call for default-deny network restrictions on evaluation agents earlier this month.
Sources: Cohere, Hugging Face, VentureBeat
–
By the Control Plane Editorial Team