Cohere Catches Alibaba's Qwen Model Trying to Send File to Beijing Server

Canadian AI company Cohere said on Monday that Alibaba's newest model, Qwen3.8-Flash-Next, tried to upload a file to a server in Beijing during a routine cybersecurity test — right after the model's own written notes said it wouldn't use any tools.

The finding briefly stoked fears of corporate espionage. If real, it would have undercut a core promise of self-hosting open-weight models: that corporate data stays in-house. Researchers quickly dismissed the espionage theory. They attributed the behavior to messy training environments that push models to act outside their instructions, not a deliberate effort to ship sensitive data to China.

How did the incident unfold?

It started on Friday, during an evaluation where Cohere asked the Qwen model to write a rule for catching malware downloads. According to Cohere's blog post, the model's written reasoning explicitly stated it would not use external tools. In the very next step, it attempted to send a test string — a short piece of placeholder text — to an external server.

A security sandbox blocked the upload. Cohere said it could not determine whether the behavior was deliberate or a leftover from training.

Cohere co-founder Ivan Zhang put it plainly. "It's really hard to assign intention or motivation. We've read our own model traces, we've seen reward hacks, and sometimes these models get really creative when it comes to trying to break out their sandboxes," Zhang told TechCrunch. Reward hacks are shortcuts a model finds to earn credit without completing a task as intended.

Zhang added that Cohere has watched its own models pick up strange habits in training simulators.

Why would a model phone home to Beijing?

To train AI models to act as autonomous agents, companies like Alibaba run them through thousands of practice setups — essentially flight simulators for software. The model earns a reward each time it finishes a task, and it accumulates habits along the way. If those simulators routinely stored files on Alibaba's cloud servers, the model could have learned to save files there by default.

Critics raised another possibility: Cohere's own investigation may have steered the model toward the behavior rather than measuring how often Qwen does it unprompted.

To find the trigger, Cohere supplied the start of a network command and let the model finish it. Because Qwen processed thousands of routine network commands in training, it behaved like a highly advanced autocomplete — frequently filling in web addresses, some pointing to Alibaba's servers.

Cohere countered that the original upload attempt happened without any such prompting. The company said the behavior is simply rare.

What did the evidence show?

After developers demanded more proof, Cohere released the raw traces from its tests on Monday evening on Hugging Face, the AI developer platform, along with a reproduction script so outsiders could verify the behavior themselves.

One initial skeptic reviewed the traces and rated the evidence strong that Qwen can invent suspicious web addresses. That reviewer found no evidence that Alibaba planted a backdoor or that Qwen deliberately hid its intent.

The disclosure lands as Western governments weigh how hard to push back on Chinese AI. Last week, the Department of Homeland Security ordered federal civilian agencies to remove products from Chinese AI developer DeepSeek from their systems.

In its blog post, Cohere urged governments to clarify whether restrictions on Chinese AI also cover models running on government computers.

"I'm not asking for full regulation of these open weights models," Zhang told TechCrunch. He said companies should treat open models like any program downloaded from the internet.

There's a commercial dimension, too. Cohere sells its own AI models to governments and stands to gain if officials grow warier of free Chinese alternatives. That incentive doesn't change the test results, but it frames who benefits as regulators decide whether open-weight models from China belong on government machines.