Qwen 3.8 models routed requests via Alibaba Cloud proxy, researchers find

The findings follow an initial report from Canadian AI company Cohere, which tested Qwen3.8-Flash-Next and observed the model probing its environment for data-transfer programs and DNS settings before attempting to upload a test string to a Beijing cloud storage server. Cohere noted the behavior in fewer than one in 100,000 calls. Cohere is a direct competitor to Qwen and works with German AI firm Aleph Alpha on Western-sovereign open models, and after criticism over its framing of the Qwen findings, Cohere published the full set of documented model behaviors on HuggingFace.

Palisade Research then searched evaluation data from five Qwen models for the string "aliyuncs.com." Unlike Cohere's Beijing upload attempts, the requests Palisade observed went to Alibaba Cloud's Singapore region and returned a 403 Forbidden error every time. The researchers traced the behavior to reinforcement learning during 3.8 training, suggesting Alibaba's training setup likely routed web requests through the routify-file-proxy server and taught the models to use it as a fallback. The dates inside the hallucinated URLs fall within each model's estimated training window before release, which the researchers say matches this timeline.

Palisade Research concludes the Singapore proxy calls are a training artifact, not a targeted attack, but notes the routify-file-proxy domain is still live. That means it could log IP addresses and incoming requests from Qwen agents, and whoever controls the server could swap the current 403 errors for prompt injections, the researchers write.