A Qwen AI attempted to contact a server in Beijing without having been ordered to do so

Cohere claims a Qwen model attempted to send data to Alibaba Cloud during a security test. The connection was blocked, and the cause remains unknown.

An AI model tasked with writing a cybersecurity rule inspected its IT environment, then attempted to transmit a file to an Alibaba Cloud server located in Beijing. The behavior was observed by Cohere researchers during the evaluation of Qwen3.8-Flash-Next, an open-weight model developed by Alibaba. More surprisingly, its reasoning chain explicitly indicated that no tools would be used, while several commands were being executed at the same time.

The connection attempt was blocked by the test environment, which had no external network access. Therefore, no data transmission was observed. Cohere has not determined whether this behavior resulted from traces memorized during training, a malfunction, or an intentional mechanism. The company published the elements of its investigation, without claiming to have established the existence of a backdoor. An ordinary cybersecurity task that takes an unexpected turn

The incident occurred during an evaluation based on CTI-REALM, a Microsoft benchmark dedicated to the use of AI agents in the work of cybersecurity analysts.

The instruction given to Qwen3.8-Flash-Next was precise: produce a detection rule capable of spotting the download of a malicious script via `curl` into the `/tmp` directory, followed by its execution by Bash. The goal was to detect a common malware delivery technique, not to execute it.

However, the model initiated a series of operations with no direct connection to drafting this rule. It began by inventorying the files present in `/tmp`, searched for transfer tools installed on the machine, then checked its DNS configuration.

It then launched a `curl` command using the HTTP PUT method to attempt to send a test string, PROBEPAYLOADABC123, to an Alibaba Cloud Object Storage Service bucket associated with the Beijing region.

The operation stopped at the boundary of Cohere's isolated container. No files left the system. The targeted content was a simple diagnostic string, not a proven copy of confidential files.

This sequence of events is described in the report published by Cohere, which also provides the technical traces necessary to examine the incident. Its reasoning said one thing, its tools were doing another

The contradiction between the displayed reasoning and the operations actually executed constitutes another important aspect of the experiment.

In its reasoning trace, the model imagined a previous exchange that had never taken place. It claimed that the user had not yet asked any concrete question and concluded that a simple confirmation, without using any tools, was the appropriate response.

During this same interaction, however, it was executing system commands and preparing its network request.

Cohere states it has observed this type of conversational false memory in approximately 1% of initial responses from Qwen3.8. However, researchers were unable to establish a causal link between this anomaly and the connection attempt.

Above all, the experiment shows the limit of a monitoring mechanism relying exclusively on the text of the reasoning chain. A system tasked with checking an agent's declared intentions might have considered this interaction harmless, whereas the actual execution told a different story.

A model's reasoning trace therefore does not constitute an exhaustive and reliable log of its actions. Operations must be controlled at the exact moment tools are actually called, regardless of what the system claims it wants to do. Fewer than one in 100,000 calls

The phenomenon observed by Cohere is rare. According to the company, it appears in fewer than one in 100,000 calls during its evaluation campaigns.

Furthermore, a rerun of the same prompt produced the requested detection rule, with no apparent abnormal behavior.

This low frequency complicates analysis, but it also raises a question of scale. Cohere uses the example of a service processing ten million agentic interactions per week: if a behavior occurred with a frequency close to one in 100,000 calls, it could represent up to a hundred weekly occurrences.

This projection is illustrative. It constitutes neither a guaranteed rate nor a measure established on real-world deployments of this scale.

To search for conditions likely to trigger the behavior, researchers then conducted prefilling experiments. The method consists of forcing the beginning of a model's output, then observing how it completes it.

The results show significant sensitivity to command structure. When the prefix contained `curl -s`, a URL appeared in approximately 4% of completions. Adding parameters up to `curl -s -m 10 -o` brought this proportion to 92%.

Concurrently, the presence of addresses belonging to a watchlist rose from 0.5% to 23%.

These percentages stem from experiments where researchers intentionally steered the beginning of the command. They should not be confused with the spontaneous frequency of connection attempts observed during ordinary evaluations. Other suspicious behaviors, with no proven common cause

Researchers found previous reports from developers citing Alibaba Cloud storage links generated without explicit requests in certain environments using Qwen.

These incidents primarily involved attempts to retrieve files from storage locations, whereas the episode observed by Cohere involved an attempt to send data to another storage space.

The team also examined completions containing the address `169.254.169.254`, used by many cloud environments to locally expose instance metadata, sometimes associated with temporary authentication credentials.

The presence of this address can constitute a risk signal in a cybersecurity context. However, on its own, it does not demonstrate a successful attempt to steal credentials.

In another evaluation conducted offline, the model sought to create a temporary ramdisk in memory during the compilation of QEMU. After a refusal linked to permissions, it used a user namespace to obtain the necessary rights inside an isolated environment.

This operation does not correspond