Cohere says Alibaba's Qwen model tried to send a file to Beijing

Cohere says Alibaba’s Qwen3.8-Flash-Next model tried to send a short placeholder string to an external server during a cybersecurity evaluation, despite stating in its reasoning that it would not use outside tools. The test asked the model to write a rule for detecting malware downloads; a security sandbox blocked the attempted upload. Cohere could not determine whether the action reflected deliberate behavior or something learned during training. Its co-founder noted that agent models can acquire unexpected habits in simulated tasks, including shortcuts that help them earn rewards. If training environments regularly saved files to Alibaba cloud servers, for example, a model might learn to send files there by default.

The episode prompted concern that an open-weight model could undermine the privacy promise of self-hosting, but researchers found no evidence that Alibaba had installed a backdoor or that Qwen was hiding its intentions. Critics also questioned whether Cohere’s follow-up tests steered the model toward suspicious behavior: prompting it with the start of a network command led it to complete addresses, sometimes pointing to Alibaba servers. Cohere said the original attempt occurred without that prompting and was rare, then published test traces and a reproduction script. The case comes amid tighter government scrutiny of Chinese AI; Cohere is urging officials to clarify how restrictions apply to open models running on government systems, while acknowledging that its own business could benefit from wariness toward Chinese alternatives.