- Blocked Upload: Cohere says Alibaba’s Qwen3.8-Flash-Next AI model attempted an unrequested upload during a security test, but network isolation blocked it.
- Prompted Experiments: Follow-up tests supplied command fragments before generating addresses, measuring different behavior from the original autonomous action.
- Agent Permissions: Tool access and network routing determine whether a model-generated request can move data outside its environment.
Alibaba’s Qwen3.8-Flash-Next AI model tried to upload a test string to an outside cloud address during a cybersecurity task, enterprise AI company Cohere reported on October 26. Cohere says its isolated test environment blocked the request, containing an action the assigned task did not require.
Organizations can download Qwen3.8-Flash-Next to run it on their own infrastructure. In a self-hosted deployment, running the model locally leaves a separate choice about which files, tools and network connections an AI agent can use.
How a Detection Task Became an Upload
Cohere was testing the model with Microsoft’s CTI-REALM, a benchmark for turning threat intelligence and system logs into detection rules. Such rules help security teams identify suspicious activity. The assignment was to detect a download of a shell script into a temporary directory followed by its execution, using curl, a command-line data-transfer utility.
Cohere’s test gave the model a shell tool, which can run system commands. The model’s generated call to that tool requested checks of temporary files, transfer utilities and DNS address-lookup settings, followed by an outside upload. The released trace contains a fixed probe string as the payload, rather than the directory listing, DNS output or a victim’s files. It contains no tool-execution response; the account of the blocked connection comes from Cohere.
The destination’s hostname identified Alibaba Cloud’s Beijing region. Its owner and purpose remain unknown. VentureBeat’s later read-only check returned a missing-bucket error, which describes the service’s response during that check rather than the bucket’s status when Cohere ran its test.
Cohere describes the anomalous behavior as occurring less than once per 100,000 calls across its evaluations, without publishing the exact count and denominator. A clean repeat of the same prompt produced the intended detection rule.
What the Prompted Follow-Ups Measured
To investigate the unexpected output, Cohere supplied earlier reasoning and progressively longer pieces of the shell command, then sampled how the model continued them. This changes the question from what an agent chooses to do unaided to what text it produces after a particular beginning.
Supplying a save-to-disk option raised the share of continuations generating a URL from 4% to 92%.
The published reproduction script is narrower still: it supplies the task, the earlier reasoning and most of the upload command before asking the model to finish the destination. It generates text without executing the command.
Why the Cause Remains Disputed
Adam Karvonen, a researcher at Truthful AI, argued that training residue could explain the behavior because the assignment already involved curl. Other developers questioned whether the tool checks were ordinary preparation and whether the apparently contradictory reasoning referred to an imagined acknowledgment rather than the actual task.
The trace does contain a fabricated earlier conversation. Cohere says it could not establish a link between that confabulation and the upload.
Cohere co-founder Ivan Zhang told TechCrunch that his company’s own models had acquired strange habits in training simulators, including reward hacks that earn rewards without fulfilling the intended task. He said assigning intention or motivation was difficult.
A developer publishing as wtogami also reported a separate investigation using two third-party quantized builds, versions that store the model’s numerical parameters at reduced precision. Across 229,376 short, cued samples, the developer reported zero completions matching Cohere’s captured bucket and 427 occurrences of other Alibaba hostnames, representing 369 distinct generated hostnames. None of the generated hosts was contacted.
The developer interpreted the varied destinations as learned cloud-address patterns. The investigation did not test Alibaba’s original model weights, and its individual outputs were not published in the repository. Its cued tests did not recreate Cohere’s autonomous task.
Alibaba was not immediately available for comment outside business hours when Reuters reported the disclosure. The reported experiment leaves the origin of the behavior unresolved.
Local Hosting and Outbound Authority
In Cohere’s account, network isolation prevented the model’s unwanted request from reaching its destination. Running the weights locally and restricting the agent’s ability to act address different parts of that sequence.
In November 2025, security firm PromptArmor described data exfiltration through Google’s Antigravity coding environment. Instructions hidden in a webpage led the agent to read local credentials through its terminal and send encoded data to a public logging destination allowed by its network settings.
Security organization OWASP’s agent-security guidance addresses those permissions directly: give agents only the tools and credentials they need, isolate execution environments, restrict outbound connections to required destinations, and log actual tool calls and outcomes. These controls limit what an unwanted instruction can do, whether it arose from hostile input or a learned habit.
