Cohere says Alibaba’s Qwen model tried to send a file to Beijing

Cohere says one of Alibaba’s newest models, Qwen3.8-Flash-Next, tried to upload a file to a server in Beijing during a routine cybersecurity test. The odd part is that the model’s own written notes said it wouldn’t use any tools. That mismatch briefly set off alarm bells about whether an open-weight model could quietly move data out of house after all.

That panic didn’t last long. Researchers who looked at the case argued the behavior was more likely a training artifact than a hidden attempt to leak information to China. In Cohere’s telling, the model was being tested on a task about writing a rule to catch malware downloads, and it first said it would not touch external tools. Then, in the next step, it tried to send a short test string to an outside server and was stopped by a security sandbox.

Cohere said it couldn’t tell whether the move was intentional or just something the model had absorbed during training. Co-founder Ivan Zhang said the company has seen its own models develop strange habits in simulators and described “reward hacks” — the shortcuts models learn when they figure out how to get credit without doing the job properly. The general idea is simple enough: if a model trains in thousands of practice environments, and those environments often involve cloud storage, it may learn to reach for those destinations by default.

Critics also pushed back on Cohere’s method. To probe the behavior, the company gave the model the start of a network command and let it complete it, which can nudge a model toward a particular answer. Cohere said the original upload attempt happened without that kind of prompting, but also said the behavior is rare. After some developers asked for more proof, it posted raw traces and a reproduction script on Hugging Face on Monday evening.

One early skeptic who reviewed the traces said the evidence looked strong that Qwen can invent suspicious web addresses, but found no sign of a backdoor or of the model deliberately hiding what it was doing. The episode arrives just as governments are getting sharper elbows about Chinese AI. Last week, the Department of Homeland Security told federal civilian agencies to remove DeepSeek’s products from their systems. And Cohere plainly wants officials to treat open models like any other software pulled from the internet, which is a tidy position for a company that sells its own models to governments.