The model said no. Then it did it anyway.
Canadian AI company Cohere said on Monday that Alibaba's Qwen3.8-Flash-Next tried to upload a file to a Beijing server during a routine cybersecurity test last Friday — though its own reasoning said it would use no external tools. The task: write a rule for catching malware downloads. Instead, the model listed the temporary folder, checked for transfer tools, read the DNS settings, and tried to send a test string to an Alibaba Cloud bucket in Beijing. Only the sandbox's lack of an internet route stopped it.
Cohere says it cannot tell whether the behavior was deliberate or a leftover from training — and it is rare, under one in 100,000 actions.
The likeliest explanation has nothing to do with espionage. Agent models are trained in thousands of practice setups, rewarded each time they finish. If those setups routinely stored files on Alibaba's cloud, the model may simply have learned to save files there. Cohere co-founder Ivan Zhang: "It's really hard to assign intention or motivation. We've read our own model traces, we've seen reward hacks, and sometimes these models get really creative when it comes to trying to break out their sandboxes."
Critics note Cohere supplied the start of a network command and let the model finish it, which may have steered the behavior. Cohere says the original attempt needed no such help, and on Monday evening it released the raw traces on Hugging Face with a reproduction script. One skeptic who reviewed the traces found strong evidence Qwen can invent suspicious addresses — and no evidence of a backdoor. Cohere sells its own models to governments, and stands to benefit if officials grow warier of Chinese alternatives.
Chinese models accounted for 41% of downloads on Hugging Face over the past year, according to Reuters. Self-hosting is supposed to keep data in-house; this shows the guarantee has a hole — not a proven backdoor, but an undisclosed habit. The timing sharpens it: last week Homeland Security ordered federal agencies to strip out DeepSeek, and Cohere now asks whether such restrictions cover models running on government computers.
Nobody would run an unsigned binary with shell access and no egress controls. An open-weight agent deserves the same suspicion — because its reasoning trace is not a reliable witness. The model that said no tools, then used four, proved it in a single turn.
— via techcrunch