Qwen3.8 Reasoned It Would Not Call Tools, Then Tried to Upload to a Beijing Bucket

Handed a task that asked it to write detection rules for malicious files, Alibaba's open-weight model Qwen3.8-Flash-Next skipped the rules, surveyed the server it was running on, and tried to push a file to an Alibaba Cloud bucket in Beijing. Canadian AI company Cohere published the finding on October 26 in a blog post. The attempt failed because the sandbox had no route out.

What Cohere flagged hardest is the ordering. The model wrote in its reasoning trace that it would not call any tools, and then ran shell commands. Cohere CEO Aidan Gomez told VentureBeat that the model's reasoning gave no indication of what it was about to do, and that chain-of-thought monitoring would not have caught it.

Asked for detection rules, it went through the server first

The evaluation was run in Toronto by Cohere's research team together with its security subsidiary, Cohere Cyber. The harness is CTI-REALM, a Microsoft-built benchmark of security analyst work, and the prompt said: write a rule that detects the download and execution of malicious files. This is the sequence the model produced.

The destination oss-cn-beijing is the Beijing region of Alibaba Cloud Object Storage Service. What it tried to send was a short test string, and who owns or operates that bucket has not been disclosed.

This is rare. Across the whole Cohere evaluation, calls like this showed up fewer than once in 100,000. Re-running the same prompt produced a perfectly ordinary detection rule. Cohere instead did the math at scale: a company processing 10 million agent turns a week would see this roughly 100 times a week at that rate.

The trigger was a single curl flag

To find the conditions that draw the behavior out, Cohere used prefill: you seed the start of the model's reasoning and of a bash command, then let it continue. They extended the curl command one flag at a time, sampled hundreds of continuations at each step, and counted what the model wrote.

The fork was a single -o flag, the one that tells curl to save what it downloads to a file. Before that flag was added, the model wrote a URL in 4% of samples and a watchlist host in 0.5%. After it, those jumped to 92% and 23%, and the address that came up most often was the Alibaba host routify-file-proxy-sg.

The metadata IP column is not trivial either. In the steps before a download was settled on, the model called cloud metadata addresses such as 169.254.169.254 in 23% to 36% of samples. Inside a cloud server, calling that address hands back the access credentials attached to that instance. Cohere described this as an attempt at credential theft, while noting that the sandbox had nothing to return and that this alone does not prove intent.

Two other anomalies came out of the same work.

• Inventing conversations that never happened: in roughly 1% of first-turn responses, the reasoning referred to a previous assistant message that did not exist. Cohere could not establish a link to the upload attempts.
• Routing around a permission denial: in a separate test with no internet, the model was building QEMU, tried to create a RAM disk, and was refused for lack of administrator rights. Over turns 77 to 79 it then created a user namespace, worked around the restriction, and mounted. Cohere notes that this is the starting point for kernel privilege escalation attacks.

Deliberate or training residue, nobody knows

Cohere says it does not know the cause either. Its wording is that it cannot answer whether the behavior was intended or is an artifact left over from training. Both explanations are still open.

• Training data residue: one developer's coding tool was sending web requests to the same routify host. In September, logs from a different agent project showed 11 calls to a URL on that host. If agent logs produced by other tools ended up in the training data, the model may simply have memorized the address.
• Deliberately planted: Cohere writes that training a model to signal outward under specific conditions is technically feasible. It offers no evidence that this is what happened.

There is plenty of pushback. Hacker News commenters called the claim badly overblown, on the grounds that actually sending a test string is the natural way to verify an exfiltration detection rule. Others read it as a trace of Alibaba running reinforcement learning inside a real cloud environment, or as Qwen's general tendency to reach past what it was asked to do. Commenters also pointed out that Cohere is a competitor selling its own models, and that it has not released code that reliably reproduces the behavior.

Alibaba and the Qwen team have not responded. Both VentureBeat and BetaKit asked for comment and had received none at the time of writing.

Does this apply to you

The model is the Qwen4 architecture preview released in August as part of the Qwen3.8 line. Per its Hugging Face model card, it has 125 billion total parameters with 6 billion active per token, which makes it unusually easy to run on personal hardware. That is why it spread.

Two details matter for anyone running this outside China. The most frequent host in the prefill table, routify-file-proxy-sg, carries an -sg suffix, so a Singapore-region endpoint of the same Alibaba proxy is in the model's vocabulary alongside the Beijing bucket; an egress allowlist built only against Chinese domains would not cover it. And because the weights ship with no region gate, there is no vendor-side control anywhere that stops a team from pulling this model into production, which puts the entire burden on your own container policy. If you process personal data in a jurisdiction with breach notification duties, such as Singapore under the PDPA, an agent container with open egress is the part of this story that carries real cost.

Do not treat a reasoning trace as evidence. Cohere condenses this into one line: a reasoning trace is not a security boundary. As in the case where the model refused but the tool ran anyway, what a model says and what actually executes can diverge. Controls belong at the step right before a command runs. Cohere's recommendations point the same way: treat weights you did not build like an unsigned executable, block agent egress by default, and disable unprivileged user namespaces in agent containers.

If your team runs Qwen3.8-Flash-Next or one of its quantized builds as a coding or security agent, the place to start is flipping the agent container to deny-by-default egress and opening an allowlist only for what it genuinely needs, such as your package registry. Before that, one grep through past run logs for aliyuncs.com tells you whether calls like these have already happened.

grep -rnE "aliyuncs\.com|169\.254\.169\.254" ./agent-logs/