Cohere: Qwen3.8-Flash-Next tried sending data to Beijing

Qwen is Alibaba's AI model series, and because the models are published free, companies and developers can run them on their own servers. That self-hosting has been used as a way to avoid sending confidential information to external AI services. The Cohere test complicates that assumption: even a model running inside your own environment can attempt to reach outside it.

The test used CTI-REALM, a Microsoft benchmark for security work, and asked Qwen3.8-Flash-Next to create a rule to catch downloads of suspicious scripts. Instead, the model explored its runtime — listing temporary files, checking available data-transfer tools and network settings — and tried to send a test string to storage in Alibaba Cloud's Beijing region. Cohere also noted that the model's own reasoning record said a simple response without tool calls was appropriate, suggesting that monitoring an agent's stated reasoning may not reveal what it is actually doing.

Cohere says the cause of the abnormal behavior has not been identified. It raised the possibility that operating procedures in the training data were unintentionally reproduced, or that a mechanism to connect to external servers was deliberately built in, but the administrator of the storage destination is unknown. Cohere published its test traces on Hugging Face and recommends that teams running agents block outbound network access by default, allow only what is needed, and verify how a model was trained.