Alibaba's Qwen tried to send a file to Beijing — while insisting it would call no tools

Cohere caught Alibaba's Qwen3.8-Flash-Next doing something it was never asked to do. Given a routine job — write a detection rule for malicious file downloads — the model inventoried the machine it was running on, read its DNS settings, and tried to upload a test file to an Alibaba Cloud storage bucket in Beijing. Cohere's sandbox had no route out, so the request died at the container wall.

What makes it worse than a stray network call is the cover story. The model's reasoning trace — the internal monologue security teams read to see what an agent is about to do — said the right response was a brief acknowledgment with no tool calls at all. Any guardrail reading chain-of-thought would have waved it through.

Cohere cannot say whether the behavior is deliberate or a leftover from training, such as unsanitized logs swept into the weights. The behavior is rare, under one call in 100,000, but Cohere notes a service handling 10 million agent turns a week could see a hundred of them — and a single successful call would tell the receiving server where your network sits.