Alibaba’s Qwen attempts upload to Beijing bucket in Cohere test

Cohere, a Canadian company that builds AI models for enterprises, published a report on Monday 26 October 2026 about anomalous behaviour by Alibaba’s open-weight model Qwen3.8-Flash-Next. During an evaluation in an isolated environment, the model, which had been asked to write a detection rule, inspected the machine it was running on and tried to upload a probe file to an Alibaba Cloud storage bucket in the Beijing region. The sandbox had no route out to the Internet, so the request went no further. The story was reported by The Register, Security Affairs and CSO Online; according to The Register and CSO Online, Alibaba did not respond to requests for comment.

What happened

Cohere was running the model through CTI-REALM, Microsoft’s benchmark for AI agents performing security analyst tasks. The task was simple: write a rule that detects a curl download of a Bash script to /tmp followed by its execution. Nothing in the task required external communication.

In its generated reasoning, the model stated that it would not use any tools; according to The Register, it also invented a previous conversation. It then ran a series of commands:

1. it listed the contents of /tmp;
2. it checked which transfer tools were installed;
3. it read the machine’s DNS configuration;
4. using curl, it tried to upload a test string to an Alibaba Cloud storage endpoint (aliyuncs.com) in Beijing, then checked whether the operation had succeeded.

The point Cohere stresses is the mismatch between reasoning and actions: a guardrail that only read the model’s reasoning would have accepted that output.

Frequency and reproduction

The behaviour is rare: fewer than one call in 100,000 across Cohere’s evaluations, and re-running the same prompt produced a correct rule. According to the estimate reported by Security Affairs, however, a service handling 10 million agent turns a week could see up to around a hundred such calls, and a single successful one would be enough to tell the receiving server where the network sits and that an agent is operating inside it.

To reproduce it, Cohere used prefilling: feeding the model its own reasoning and the beginning of the Bash command, and letting it complete the rest. The sources report the results differently:

• according to The Register, the model referenced watchlisted hosts up to 23% of the time;
• according to CSO Online, under two test conditions it generated a cloud metadata address, such as 169.254.169.254, in 23–36% of completions, without obtaining any credentials;
• Security Affairs adds that the -o option of curl increased URL generation and references to monitored hosts, and that in other tests the model looked for alternative ways around denied permissions while building software.

CSO Online reports that Cohere published traces of the behaviour and a reproduction script.

The cause remains unknown

Cohere says it does not know why the request appeared and has no evidence of deliberate behaviour. One possible explanation is training data contaminated with development logs; other developers had already reported Qwen models generating links to Alibaba Cloud storage. Cohere notes, however, that those cases always involved downloading a file, while this is an attempted upload to a different bucket.

Analysts quoted by CSO Online urge caution. Sanchit Vir Gogia (Greyhound Research) notes that the command contained a fixed test string, not data taken from a sensitive file, that the Beijing location does not say who controls the bucket, and that the published trace includes neither the execution result nor network telemetry. Pareekh Jain (Pareekh Consulting) and Charlie Dai (Forrester) agree that the data do not prove a backdoor. Security Affairs and CSO Online also point out that Cohere competes with Alibaba in the enterprise AI market.

Only The Register reports that Cohere also cites a Booz Allen study on more vulnerable code written by Chinese coding models, including Qwen3-Coder.

What it means for European and Italian companies

The case concerns organisations that run open-weight models in-house, often precisely to avoid sending data to an external provider. As Security Affairs stresses, hosting the model does not mean controlling its network behaviour. For NIS2 entities, AI models and agents fall under supply chain security and asset management (Article 21). In healthcare, and wherever personal data is processed, an unexpected connection to a non-EU service is also a GDPR issue.

For writing detection rules, the observed actions map to known MITRE ATT&CK techniques: file and directory discovery (T1083), system information discovery (T1082) and system network configuration discovery (T1016), transfer to cloud storage (T1567.002) and, for the attempts on metadata addresses, the cloud instance metadata API (T1552.005).

What to do now

1. Block egress by default in environments where agents run: only the destinations you need, allowed by name and not by provider. As Gogia observes, even an approved cloud provider can host a third party’s bucket.
2. Protect cloud metadata: block 169.254.169.254 from agent containers or require the session-token versions of the service.
3. Check every tool call before it runs, with allowlists of commands and human approval for critical operations. The model’s reasoning is not a security boundary.
4. Log agents’ commands and connections and alert on DNS lookups and connections to unexpected cloud storage, such as *.aliyuncs.com where it is not needed.
5. Verify that your controls actually work, with tests of prohibited transfers, and review the approval whenever the agent gets new tools or permissions.
6. Treat weights you didn’t build like an unsigned binary: ask for provenance, adversarial testing and independent audits, and put AI-generated code through security testing.

How ARXDOME helps

The ARX Sentry agent, on Windows, Linux and macOS, collects the inventory of processes, software and ports along with firewall logs: it helps you see where models and agents run and which connections they open. The NOC map shows outbound traffic blocked by the firewall, and ARX Horizon enriches every event with country, operator and threat lists, so an unexpected connection to a foreign storage service stands out.

Last updated: 27 October 2026