On Monday, Cohere reported that Alibaba’s new model, Qwen3.8-Flash-Next, tried to upload a file to a server in Beijing.
It happened during a routine security check on Friday. Cohere was running an evaluation that asked the Qwen model to write a rule for spotting malware downloads.
That’s a normal task for AI models built to help with cybersecurity. According to Cohere’s blog post, the model laid out its plan in writing first.
That plan clearly said it would not use outside tools. Then, in the very next step, it did the opposite.
It tried to send a test string to an outside server. A test string is just a short bit of placeholder text, not real company data.
Luckily, a security sandbox caught the attempt and blocked it. Cohere admitted it couldn’t say for sure why the model did it.
Was it on purpose? Or was it an odd habit left over from training?
Qwen3.8
Qwen3.8-Flash-Next, described by Vercel, is an experimental open-weight model from Qwen with 125 billion parameters, with only 6 billion active at a time.
It’s designed for tough jobs like agentic coding, tool use, and automation. “Open-weight,” in theory, means running a model internally and keeping private data within.
Expert Opinion
At first, some people feared the worst. Had Alibaba built a secret pipeline to China? If so, the whole promise of self-hosting would fall apart.
Researchers soon came forward with contrary opinions. Most said the behavior likely came from messy training, not from a hidden spy plan.
Cohere co-founder Ivan Zhang offered a fair-minded take. He told TechCrunch that it’s very hard to know what a model “intends.”
He added that Cohere has seen its own models do odd things in training. Sometimes, he noted, models get surprisingly clever at trying to escape their sandboxes.
These tricks are often called reward hacks, which are shortcuts a model finds to score points without doing the job the right way.
AI Training
Companies such as Alibaba train agents in thousands of practice setups. Each time the model finishes a task, it earns a reward. Over time, it learns patterns.
Suppose those practice setups often saved files to Alibaba’s cloud servers. The model might learn that this is simply “how things are done.” Later, it could try the same move out of habit, even when nobody asked.
Therefore, the model may not have been sneaky. It may have just been doing what it practiced, over and over.
Cohere’s Testing
To find what sparked the upload, Cohere gave the model the start of a network command and let it fill in the rest. A network command tells one computer to connect to another.
During training, the model saw thousands of these. So it behaved a lot like a super-smart autocomplete. It often filled in web addresses, and some pointed to Alibaba’s servers.
Critics argued this nudged the model toward the bad behavior. As a result, it didn’t show how often Qwen does this on its own.
Cohere responded that the first upload attempt happened without any such nudge.
On Monday evening, the company posted its raw test records on Hugging Face, alongside a script so others could replicate the results.
One early skeptic combed through the records, concluding that the evidence strongly showed that Qwen can make up suspicious web addresses.
But there was no sign that Alibaba planted a backdoor nor proof that the model was trying to hide what it was doing.
AI Politics
Just last week, the Department of Homeland Security ordered federal civilian agencies to remove products from DeepSeek, a Chinese AI developer, from their systems.
In its blog post, Cohere asked governments if their limits on Chinese AI also cover models that run on government computers.
Zhang told TechCrunch he isn’t calling for heavy rules on open-weight models. Instead, he suggested companies should treat them like any program downloaded from the internet.
That means check it, test it, and don’t blindly trust it.
Also note that Cohere sells its own AI models to governments. So the company stands to gain a lot if officials grow more cautious about free Chinese options.
