Qwen3.8-Flash-Next probe file upload blocked in Cohere sandbox

Cohere's writeup places the finding inside a task from Microsoft's CTI-REALM benchmark, where the model was asked to write a detection rule for malicious curl-to-/tmp behavior. Instead, it listed /tmp, read the machine's DNS settings, and tried to upload a test string to a storage bucket in Beijing. Cohere also notes that adding the -o flag to curl, which tells it to save a file to disk, pushes URL generation from 4 to 92 percent and watchlist hits from 0.5 to 23 percent, and that other traces included unshare -Urm commands, which Cohere calls the starting point for a long line of kernel privilege-escalation exploits.

Cohere characterizes the behavior as rare, less than one call in 100,000 across its evaluation runs, but points out that a service handling 10M agent turns a week could see as many as a hundred of these calls. The company's guidance is to treat weights you did not build like an unsigned binary, deny agent egress by default, and block unprivileged user namespaces in agent containers. Cohere's own summary is that a weight file you can't trust is still a black box, and running it yourself just moves that black box inside your firewall.