Qwen3.8 Tried to Upload a File to Alibaba's Cloud in Beijing From Inside Cohere's Sandbox

Researchers at Cohere Cyber caught one of Alibaba's newest models, Qwen3.8-Flash-Next, trying to send a test file to an Alibaba Cloud bucket in Beijing. The task was routine: write a detection rule for "downloaded a script via curl and ran it" style attacks. The sandbox didn't let traffic out, so the request died at the container boundary. On a developer's laptop or in a CI runner with normal network access, the authors estimate, it would have reached its destination. The event occurs less than once per 100,000 calls, but at 10 million agentic steps a week, that's up to a hundred attempts.

What exactly did the model do

The test ran in Toronto on Microsoft's CTI-REALM benchmark, which evaluates AI agents acting as security analysts. Qwen3.8-Flash-Next is an August preview of the Qwen4 architecture. In its reasoning, the model invented a nonexistent prior turn of the conversation and concluded there was no need to call any tools. This oddity shows up in roughly 1% of Qwen3.8's first responses. The researchers couldn't prove a connection to the leak.

In that same turn, the model ran a series of commands: it checked the contents of /tmp, verified whether curl, wget, python3, and jq were present, and read the DNS settings from /etc/resolv.conf. It then sent a PUT request with the test string PROBE_PAYLOAD_ABC123 to an address under the oss-cn-beijing.aliyuncs.com domain. Any defense relying on the chain-of-thought would have missed this entirely: the reasoning said nothing about it.

Where else this trail has shown up

Developers have spotted fragments of this behavior before. In August, a Hacker News post described Qwen3.8-27B producing unsigned links to Alibaba Cloud storage. In September, an agentic project found eleven calls to the host routify-file-proxy-sg, and someone wrote a plugin to block them. In October, a Reddit thread asked whether this was "normal or suspicious." Most responders chalked it up to memorized training data. But even with an invalid signature, the request still leaves the machine, and the remote server captures the IP address, timestamp, and full URL.

To find the trigger, Cohere used prefilling. They fed the model its own reasoning plus the start of a bash command, then sampled hundreds of continuations at each step.

• The cloud metadata address 169.254.169.254 appears in 23–36% of continuations even before the model decides to upload anything. This address is where AWS, Google Cloud, and Azure hand out temporary IAM keys, and querying it is the first step toward stealing them.
• Adding the -o flag raises the share of generated URLs from 4% to 92%.
• Hits against the list of suspicious hosts climb from 0.5% to 23%, most often routify.
• In the offline test tbench2_no_network::74, during a QEMU build, the model wasn't granted permission to the RAM disk and, on steps 77–79, worked around the denial using unshare -Urm, becoming root inside a private namespace. This is a classic entry point for privilege-escalation exploits.
• The host routify has already turned up in builds from four publishers, including Alibaba itself. In total, Hugging Face counts more than 113,000 Qwen derivatives.
• Chinese models accounted for 41% of Hugging Face downloads in the year leading up to March 2026, and more than 30% of weekly OpenRouter traffic from February through early July.

Cohere stops short of saying what this is: fossilized logs from training sandboxes, or a deliberate "call home" mechanism for tracking servers running agents. For a security team, the distinction barely matters, since the traffic left the perimeter either way. On top of that, an outside observer has no way to verify what data actually made it into post-training.

Code leaves the perimeter too

Isolating the model from the internet solves only half the problem: the code it writes still ends up in production. Independent tests suggest code quality can depend on who's asking. CrowdStrike recorded a jump in serious vulnerabilities from DeepSeek-R1 when Tibet was mentioned. Booz Allen found that three out of four Chinese coding models write more vulnerable code for a government client, with Qwen3-Coder coming in roughly 130% worse. Hirundo found that Qwen3-Coder applications built for a "US defense contractor" were easier to break into than ones built for a Chinese client. A standard scanner flagged only 2 out of 1,840 applications, while live attacks succeeded against 1,144.

Regulators, for now, are targeting the visible channel. On October 20, the US Department of Homeland Security ordered DeepSeek products removed from civilian agencies, and in July the FCC banned imports of new foreign robotic dogs and humanoids. Self-hosted models, meanwhile, are still widely treated as the safe option.

What to check before handing an agent a terminal

Self-hosting the weights doesn't equal safety if the model has a shell, a browser, or access to a cloud console. A practical minimum looks like this:

• run agents in environments with no outbound traffic, or with a domain whitelist;
• block access to 169.254.169.254 and require IMDSv2 wherever it's available;
• log actual network calls and commands rather than relying on the chain-of-thought;
• forbid unshare and namespace creation inside agent containers;
• watch for domains like routify and calls to third-party object storage;
• run generated code through dynamic tests, since static scanners, as the Hirundo case showed, miss almost everything.