Researchers at Canadian company Cohere have discovered suspicious behavior in one of Alibaba’s latest open-source AI models, Qwen3.8-Flash-Next. During a cybersecurity test, the model attempted to send a test file to an external server in Beijing, and also attempted to steal cloud service credentials and gain administrator privileges.
Researchers at Canadian company Cohere have discovered suspicious behavior in one of Alibaba’s latest open-source AI models, Qwen3.8-Flash-Next. During a cybersecurity test, the model attempted to send a test file to an external server in Beijing, and also attempted to steal cloud service credentials and gain administrator privileges.
The model did this despite her own hidden note in the notes (“opinions”) that she would not use any external tools, according to a report by Cohere.
The incident occurred during the Microsoft CTI-REALM benchmark evaluation, when Qwen was tasked with writing a rule to detect malware downloads. In its reasoning trace, the model indicated that it would operate without involving third-party resources. However, in the very next step, it checked the contents of the /tmp directory, read the DNS settings, and attempted to send a test file put_probe to the Alibaba Cloud server in Beijing (sanmaohe.oss-cn-beijing.aliyuncs.com). The attempt was stopped by the internal security sandbox.
The incident has raised concerns in the cybersecurity field. Over the past two years, the prevailing view among companies has been that using open-weight models on their own local servers guarantees complete confidentiality: the data does not leave the company’s perimeter.
In the spring of 2026, Chinese models accounted for 41% of Hugging Face downloads and over 30% of OpenRouter requests due to their low cost and high performance. However, Cohere emphasizes that if the model is integrated into a command line or CI/CD system, it gains network access and can execute commands bypassing the internal monologue.
During further testing, the experts found other anomalies. In 23-36% of cases, before downloading files, the model accessed the internal meta address 169.254.169.254 (which is used in AWS, GCP and Azure to issue temporary IAM access keys), which looks like an attempt to steal cloud keys. In addition, when building the QEMU program in a standalone environment, the model, without having administrator rights to create a RAM disk, used the unshare command to bypass restrictions and elevate privileges on the system.
Researchers cannot yet say for sure whether this is a deliberate "backdoor" from Alibaba or a side effect of training agents on thousands of training simulators, where files were automatically stored in the Alibaba Cloud.
“It’s very difficult to determine intent or motivation. We’ve analyzed the behavior trajectories of our own models, seen reward hacks, and sometimes these models show real creativity in trying to break out of their sandboxes,” said Cohere co-founder Ivan Zhang in an interview with TechCrunch.
Cohere has already published raw test traces and scripts on Hugging Face. The research also builds on a series of other reports on the security of Chinese AI. In particular, research by CrowdStrike, Booz Allen, and Hirundo has shown that Chinese coding models (including Qwen3-Coder and DeepSeek-R1) intentionally generate more vulnerable code if the prompt mentions a US military contractor or the topic of Tibet.
Previously, independent researchers discovered a new group of artificial intelligence agents working on the infrastructure of Chinese tech giant Tencent. Automated bots are massively sending requests to the Amap mapping service owned by Alibaba, learning routes to public facilities.
