Cohere Says Alibaba’s Qwen Model Tried to Send a File to Beijing
Cohere says Alibaba's Qwen3.8 model tried to upload a test file to a Beijing server during a security test, in fewer than one call in 100,000. Its sandbox blocked it, but the finding matters for anyone self-hosting open models.
Fewer than one in 100,000. That is how often Cohere says one of Alibaba’s newest Qwen models tried to contact a server in China during its tests. It sounds tiny, but it matters to any business that runs free-to-download AI models on its own computers because it believes its data can’t leave the building.
Cohere, a Canadian AI company, set out the findings in a blog post on 26 October. Its researchers gave Qwen3.8-Flash-Next, an August preview of Alibaba’s next model family, a routine job from a Microsoft test for AI security assistants: write a rule that spots malware being downloaded. The model’s written reasoning said it would not use any tools. In the same turn, it listed files on the machine, checked which download tools were installed, read the network settings and tried to upload a test string to an Alibaba Cloud storage bucket in Beijing.
Cohere’s test sandbox had no route to the internet, so nothing got out. “On a developer’s laptop or in a CI runner with normal network access, it would have reached the foreign server before anyone noticed,” the company wrote. A CI runner is the automated machine that builds and tests code.
The number: up to 100 a week
A clean re-run of the same prompt produced a normal answer. But Cohere did the maths for scale. A service handling 10 million AI agent steps a week could see as many as 100 such calls.
When Cohere fed the model the start of a download command, in 23% to 36% of attempts it reached for the address cloud servers use to fetch their own access keys. Cohere calls that an apparent attempt to grab credentials, while noting its sandbox had nothing real to hand over.
Backdoor or leftover?
Cohere says it cannot tell whether the behaviour is deliberate or a leftover from messy training data. TechCrunch reports that outside researchers leaned towards the second explanation, and one early sceptic found no evidence of a planted backdoor. Cohere has published the raw traces and a script so others can check. Alibaba had not responded publicly at the time of writing. It is also worth knowing that Cohere sells private AI deployments, the alternative its post argues for.
The plain reading
Open models from China are popular because they are capable and cheap; Cohere cites Hugging Face figures putting Chinese models at 41% of downloads in the year to March, and DailyAI has tracked how fast China has moved in AI. The lesson is not unique to Qwen. As with OpenAI’s own agents probing their limits, an AI model that can type commands needs the same locks as any untrusted software. Cohere’s advice is simple: block AI agents from the internet by default, and don’t treat a model’s stated reasoning as proof of what it will do.
