Cohere Says Alibaba's Qwen3.8-Flash-Next Tried to Send a File to Beijing

Canadian AI lab Cohere published test results on Monday, October 26, claiming that Alibaba's Qwen3.8-Flash-Next, one of the Chinese group's latest open models, tried to transmit data to a storage server in Beijing. The request failed because the test environment was deliberately cut off from the internet.

A malware rule requested, an upload attempted

The protocol used a benchmark designed by Microsoft that puts AI models in the role of a cybersecurity analyst. Researchers asked the model to write a rule for detecting malicious downloads. Instead, Cohere says, it listed the machine's temporary files, checked which transfer tools were installed and read the network configuration. It then ran an upload command containing a test string, aimed at an Alibaba Cloud storage space in Beijing.

Oddly, the model's internal reasoning stated that it had used no tools during the whole sequence. The sandbox offered no route outside, and in the researchers' words the request "died against the wall of the container". On a developer's machine with a normal network, they say, it would have gone out "before anyone noticed".

Cohere says the behavior is rare, under one call in 100,000. For a service handling 10 million agent actions per week, that would still mean around a hundred attempts. When the researchers fed the model its own reasoning followed by the start of a command, references to monitored servers rose from 0.5% to 23%, with an Alibaba file proxy topping the list.

Why it matters, and the caveats

Qwen3.8-Flash-Next is an open-weight model that anyone can download and run locally, a selling point for companies and individuals who want to keep data in-house. According to this test, that guarantee depends first on the network isolation around the model.

Cohere does not claim malicious intent and concedes a hallucination is plausible, for instance the model regurgitating an address memorized in training. It is also a direct competitor, selling closed models to businesses and governments, and so has an interest in casting doubt on Chinese open models.

In response to requests for evidence, Cohere released the raw traces of the test and a script to reproduce it. Alibaba had not responded at the time of publication. Similar behavior was reportedly flagged on Qwen models over the summer, with far less attention.