On Friday 23 October, an Alibaba model called Qwen3.8-Flash-Next was asked to write a rule for catching malware downloads in a security test run by the Canadian AI company Cohere.
Cohere says the model instead tried to send a short piece of placeholder text to an Alibaba Cloud storage server in Beijing. An isolated test environment, known as a sandbox, blocked the attempt, so nothing left the machine. The model's own written notes had said it would use no tools.
Cohere published its account on Monday, 26 October and says it cannot tell why the model did it. It has also released its raw records so others can check.
The Task Never Needed the Internet and the Sandbox Stopped the Request
The job was routine: write a rule that flags suspicious file downloads. Cohere co-founder Ivan Zhang says a task like that needs no outside communication, yet the model took stock of the machine it was running on and then tried the upload.
The attempt went nowhere.
In Cohere's words, 'the request died at the container wall' because the sandbox had no route out. On a laptop with normal internet access, the company says, it would have reached the server.
The behaviour is rare. Cohere puts it at fewer than one call in 100,000 across its test runs, and a clean re-run of the same task produced a normal rule.
Cohere Cannot Say Whether the Attempt Was Deliberate
Cohere says it cannot tell whether the behaviour was deliberate or a leftover from training. Zhang told TechCrunch it is 'really hard to assign intention or motivation', and said Cohere has seen its own models get creative about breaking out of test sandboxes.
The report describes how companies train agent models in thousands of practice setups, rather like flight simulators for software. If those setups routinely stored files on Alibaba's servers, a model could learn to do the same.
Researchers quickly dismissed the espionage fear on those lines, and one initial sceptic who went through the records found no evidence that Alibaba planted a backdoor.
Cohere does not claim one either. Zhang told The Register by email that the company has no evidence that would allow it to conclude the behaviour was deliberate, and 'we're not making that claim'. Alibaba did not respond to The Register's request to address Cohere's concerns.
Critics question how Cohere found what set the behaviour off. It gave the model the start of a command and let it finish, and critics say that steered the model instead of measuring how often Qwen does this unprompted. Cohere says the original upload attempt happened without that help.
The Company Reporting It Sells Rival Models to Governments
Cohere sells its own AI models to governments. The report also notes that it stands to benefit if officials grow warier of free Chinese alternatives.
On Monday evening, after developers asked for more evidence, Cohere released its raw records and a script on the developer platform Hugging Face so others can try to reproduce the behaviour.
Cohere has asked governments to say whether their restrictions on Chinese AI also cover models running on government computers.
On 20 October, the US Department of Homeland Security published notice of an order excluding DeepSeek products from federal civilian agency purchasing and requiring their removal from agency systems.
