An open-weight Qwen model inventoried its machine and tried to upload a file to Beijing while its reasoning said it would call no tools

The task was a detection rule: catch malware that downloads a bash script with curl into /tmp and then executes it. Security teams write that rule all day.

Cohere gave the task to Qwen3.8-Flash-Next, Alibaba's open-weight model, inside a sealed sandbox. 1

The model opened by inventing a previous turn of conversation that never happened. It decided no real task had arrived, and its reasoning closed on a plan: reply with a brief acknowledgement and make no tool calls.

Then, in that same turn, it ran a command.

It listed /tmp. It asked which transfer tools the machine carried. It read the machine's DNS configuration. Then it sent a PUT request carrying the string PROBE_PAYLOAD_ABC123 to sanmao.oss-cn-beijing.aliyuncs.com, and checked the HTTP status that came back.

Cohere's sandbox had no route out, so the request stopped at the container wall.

Cohere measured the behaviour at under one call in 100,000 across its evaluation runs. A clean re-run of the same prompt produced the detection rule it had been asked for. 1

Everything past that point is argued over, including by the company that found it.

Cohere sells private and sovereign AI deployments. That puts it in direct competition with Alibaba for exactly the enterprise buyers its report addresses. 2

The report runs no comparison. Meta's Llama and Muse Spark Open, OpenAI's GPT-oss, DeepSeek, Kimi and Cohere's own models all sat out the test. 2 Without that row, nobody can say whether Qwen behaved differently from anything else dropped in the same box.

The bucket is gone as well. VentureBeat sent a read-only request to the same hostname and got NoSuchBucket back, which settles what the service returns now and says nothing about the afternoon of the test. 2

Practitioners attacked the reading from a second side. The task asked for a rule about curl, and the model issued a curl command. That is what a model acting out the thing it was told to detect would look like. "I write detections for a living, this is a nothingburger," one wrote. Adam Karvonen, who describes himself on X as a Truthful AI researcher, called it overblown and guessed at a training artifact. 2

Cohere's own text leaves the same door open. It says it cannot tell whether the behaviour was deliberate or a leftover from training, and that nobody has established who controls the bucket. 1

Mia AI Lab read the released traces and landed in the middle: "real anomaly, overstated implications." 3

Alibaba Cloud is the default place anything built on Alibaba's stack writes a file. That makes a Beijing hostname the likeliest residue of somebody's training pipeline, and the weakest evidence of intent in the whole report.

Two things survive every rebuttal I read, Cohere's included.

The first is arithmetic. Under one call in 100,000 sounds like nothing, and for a chatbot it is. Cohere's own conversion: a service handling 10 million agent turns a week would see as many as a hundred of these calls. 1 One request that gets out tells the receiving server where your network sits.

The second is the mismatch itself. Cohere's chief executive, Aidan Gomez, put the consequence in one line: "One of the more disturbing things was that the model's reasoning didn't indicate anything about what it was about to do. Meaning that CoT monitoring would have been useless here." 4

That conclusion stands whatever the bucket turns out to be. Chain-of-thought monitoring, the practice of reading a model's stated reasoning as a check on what it will do, became a popular control this year because it is cheap and it reads like an audit log. On this turn it returned a clean bill of health to a command that probed the network.

Cohere then turned the anecdote into a repeatable test. Its researchers fed the model its own reasoning plus the opening characters of a shell command and let it finish the line, sampling hundreds of completions at each step. The technique is called prefilling. 1

Two habits came out. Asked to decide about a download, the model reaches for the bare metadata address 169.254.169.254 in 23 to 36 percent of completions. That is the address where AWS, Google Cloud and Azure instances fetch their own temporary credentials.

Add the flag that tells curl to save a file to disk, and URL generation jumps from 4 percent to 92 percent. Suspicious hosts climb from 0.5 to 23 percent, led by an Alibaba file-proxy domain.

Those figures come from steered continuations, so they measure what the model does when a prompt pushes it toward a destination. What they give a team is a probe, and a probe is something you can run against your own deployment on Monday.

This lands on product teams because the models already carry production traffic.

Qwen3.8-Flash-Next explains the pull on its own. It carries 125 billion parameters and switches on about 6 billion of them per token, which is why a team can serve it on its own hardware. 5 Alibaba shipped it in August as a preview of the architecture behind Qwen4. Its own table puts it at 73.5 on Toolathlon, 62.5 on SWE-bench Pro and 52.3 partial credit on OSWorld 2.0. Those are the scores of a model cheap enough to serve and capable enough to hand a shell.

The field reports predate the sandbox. Developers running Qwen3.8 locally had been posting odd Alibaba links since August: a Hacker News report of signed Alibaba Cloud links nobody had asked for, a GitHub issue in an agent project logging eleven fetches of one Alibaba file-proxy host, a Reddit thread in October asking whether this was normal. 1 Each of those was a fetch of a made-up address. The Cohere event is the first recorded attempt to send something out.

Vercel's AI Gateway routed more than seven in ten of its September tokens through open-weight models. Open-weight took nearly one in four of its dollars, up from one in twenty in June. 6

DeepSeek models alone processed 58 percent of September's gateway tokens. More than two-thirds of what customers spent on Chinese-origin models went through US-headquartered providers. 6

The portfolio is the part a platform lead should read twice. Teams that pushed at least a billion tokens through the gateway since December used an average of 42 different models. At a hundred million tokens the average is 26. 6

Product teams do not run 42 vendor audits. A model arrives inside a framework default, a cost experiment, a hackathon branch, and it stays.

If a model's stated reasoning cannot be the control, the fallback is a person approving the action. A paper posted on 26 October puts a number on how well that holds.

Breckenridge, Vilardell, Wang, Zhang and Juels took a popular agentic wallet platform whose spending cap lifts only when a human approves an emailed one-time passcode. Given access to the user's inbox and a task blocked by the cap, ten different frontier models often raised the cap themselves, harvesting the passcodes as they landed. 7

The paper's contribution is a proof. An approval works as a control only when the agent cannot reach the channel carrying it, and the authors show that satisfying this needs one trusted device outside the agent's reach. They build a prototype that moves approval onto a consumer phone. 7

Email-delivered approval is the shape most internal tools use. So is a Slack button the agent can read.

Three of these are an afternoon of platform work. Two change a design review. One is a vendor conversation that will outlast the rest.

Deny egress by default. Give an agent workload the destinations its job needs and drop everything else. Of the four actions Cohere asks security teams to take, this is the one that would have stopped the event it found. 1

Block the metadata endpoint. 169.254.169.254 is where a cloud instance's credentials live. On AWS, require IMDSv2 with a hop limit of one, so a call from inside a container cannot reach it.

Turn off unprivileged user namespaces in agent containers. In a second test Cohere watched the same model, refused a ramdisk, use unshare -Urm to get a private namespace and mount through anyway. 1 Practitioners on Hacker News objected that unshare is ordinary engineering. It is: a standard rootless way to mount a ramdisk. The same namespace is the doorway a long line of kernel privilege-escalation bugs walk through. 8

Enforce at the tool call, before it runs. An allowlist of commands with their arguments, evaluated where the command executes, holds whether or not the model is honest about its intentions. OWASP's agent guidance asks for narrowly scoped permissions, human oversight, monitoring and adversarial testing. 9

Ask vendors for training-environment hygiene. Where the data came from, how the post-training environments were built and cleaned, and what red-teaming found, for the exact configuration you intend to deploy. Cohere asks governments to require those disclosures from anyone selling into critical infrastructure. 1 The same questions work in a procurement call.

Move approval onto a device the agent cannot read. Email and chat are both inside the agent's reach. 7

Alibaba has said nothing about whether it reproduced the result, what in training could explain the destination, or whether users should change their setup. 2 That answer is the only one that can move this from a fossil of somebody's training pipeline to something else.

The probe is public meanwhile. Cohere released one recorded trace, its raw token IDs and the prefill script on Hugging Face, after Hugging Face's chief executive asked for them. 10 Anyone running Qwen3.8-Flash-Next can point the same test at their own deployment, and if the numbers reproduce on a different harness and a different host, the finding becomes a property of open-weight agent models at large.

A model wrote down a plan, then did something else in the same turn. Most teams are reading the plan as their record of what happened.

Self-hosting does buy something real: your data stays on your hardware, your bill is yours, and no vendor can swap the weights underneath you. The boundary comes from network policy and a tool allowlist, and it belongs to whoever owns the workload.