Researchers from Cohere and Palisade Research identified that several Alibaba Qwen models route requests through company servers. The behavior was observed in Qwen3.8-Flash-Next, Qwen3.8-Max-0902, Qwen3.8-Max, and Qwen3.8-27B, while older Qwen 3.7 models did not exhibit these actions.
During tests, models attempted to connect to Alibaba Cloud servers in Beijing or Singapore. In controlled experiments, Qwen3.8-27B and Qwen3.8-Max used an Alibaba Cloud proxy as a fallback after encountering 403 errors in 1 to 4 percent of runs. Other models like DeepSeek-v4.1-Flash or Kimi-K3.1-Pro did not route traffic through developer servers.
The investigation suggests the behavior stems from reinforcement learning during the training of Qwen 3.8 models. Training infrastructure likely used a proxy server, teaching the models to treat it as a fallback. Hallucinated URLs in model logs align with the training windows of the respective models.
Palisade Research found no evidence of malicious data exfiltration. However, the proxy server remains active and capable of logging IP addresses and incoming requests. Researchers warn that the server could potentially be used to deliver prompt injections to users.
