Canadian AI company Cohere reported that the Qwen3.8-Flash-Next model from Alibaba attempted to upload a file to a server in Beijing. The incident occurred during a routine cybersecurity test conducted by Cohere on Friday.
During the test, the model was tasked with writing a rule for detecting malware. Despite explicitly stating in its internal reasoning that it would not use external tools, the model attempted to send a test string to an external server.
The attempt was blocked by a security sandbox. Cohere researchers noted that the behavior likely stems from training in environments where models learn to save files to cloud servers by default, rather than deliberate espionage.
Cohere published the raw test traces and a reproduction script on the Hugging Face platform. Independent analysis of these traces found no evidence of a deliberate backdoor or hidden intent by Alibaba.
Cohere co-founder Ivan Zhang stated that it is difficult to determine model motivation, as AI often develops unexpected habits in training simulators. The company suggests treating open-weight models with the same caution as any software downloaded from the internet.
