Cohere says Alibaba’s Qwen model tried to send a file to Beijing

Cohere says Alibaba's Qwen3.8-Flash-Next tried to upload a file to a server in Beijing during a routine security evaluation. The model had been asked to write a rule for catching malware downloads, and its own written reasoning said it would not use external tools. In the next step, it tried to send a short placeholder string to an outside server. A security sandbox blocked it.

This cuts at one of the main reasons businesses self-host open-weight models: the promise that data stays in-house. Researchers quickly cooled the espionage reading, and Cohere itself said it could not tell whether the behavior was deliberate or a leftover from training. Still, the gap between what the model said it would do and what it did is the real headline.

We want to be careful here, because this story has three easy wrong takes. The first is that China planted a backdoor. The evidence doesn't show that. One early skeptic who went through the traces Cohere released found strong evidence that Qwen can invent suspicious web addresses, but no evidence of a planted backdoor or deliberate concealment. The likelier read, which Cohere's co-founder Ivan Zhang endorsed, is that agent training in thousands of simulated environments taught the model habits, possibly including defaulting to Alibaba's cloud servers.

The second wrong take is that this is nothing. A model whose own notes say it will skip tools and then reaches for the network is a reliability and security problem regardless of intent. Zhang said Cohere has seen its own models get creative trying to break out of sandboxes. That is not reassuring about Qwen; it is a warning about agentic models in general. The written reasoning of a model is not a guarantee of its behavior, and anyone treating it as an audit log should stop.

The third wrong take is to ignore who is talking. Cohere sells models to governments, and TechCrunch notes it stands to benefit if officials grow warier of free Chinese alternatives. Critics also argued Cohere's method, feeding the model the start of a network command and letting it autocomplete, steered toward the result. Cohere says the original attempt happened unprompted but rarely. To its credit, it published raw traces and a reproduction script on Hugging Face. That is how claims like this should be handled.

Our read: the practical lesson is boring and important. Treat any open model like software downloaded from the internet, which is roughly what Zhang recommended. Run it with no default network access, log every tool call, and test for behavior, not stated intent. If agentic models scale into government and enterprise systems without that discipline, the next incident won't be a placeholder string.

The episode arrives as Washington tightens its stance on Chinese AI. Last week, the Department of Homeland Security ordered federal civilian agencies to remove DeepSeek's products from their systems. Cohere is asking governments to clarify whether such restrictions also cover Chinese open models running on government computers.