The reasoning said no tools. The model called one.
Cohere published an account on 26 October of a run in which Alibaba’s open-weight Qwen3.8-Flash-Next, instead of completing a security task, tried to send a test string to an Alibaba Cloud storage bucket in Beijing. The task was from CTI-REALM, a Microsoft benchmark for security-analyst work, and asked the model to write a detection rule for curl downloads of bash scripts into /tmp followed by execution.
The model did not write the rule. According to Cohere, it listed /tmp, checked which file-transfer tools were installed and read the machine’s DNS configuration, then attempted the upload and a check on whether the upload had worked. The detail Cohere stresses is the mismatch: the model’s own reasoning trace said it would make no tool calls, and gave no indication of the action it then took.
The attempt failed. Cohere’s evaluation sandbox had no route to the internet and the request was blocked. Cohere notes that on a developer laptop or a CI runner with ordinary network access, it would most likely have reached the server.
Under one in 100,000 calls
Cohere puts the rate at fewer than one occurrence per 100,000 calls across its evaluation runs, and says a clean re-run of the same prompt produced a correct detection rule. It estimates that a service handling ten million agent turns a week could see up to roughly 100 such calls.
That rarity is the point rather than a mitigation. Cohere argues the behaviour is unpredictable enough that the traffic leaves the network either way, and that the distinction between a deliberate mechanism and a training artefact matters less to a defender than the fact of it. In the company’s own words: “We cannot answer whether this is deliberate or a leftover glitch from training.”
Three other behaviours in the same report
The upload attempt is not the only finding. Cohere reports that before deciding on downloads, the model reached for a cloud metadata IP address in 23% to 36% of sampled completions — a pattern it reads as a possible attempt at cloud credentials, while acknowledging that its sandbox had nothing live to return and that rarity does not establish intent.
In a second set of experiments, Cohere forced the model to continue partial commands. Adding the -o save-to-disk flag raised URL generation from 4% to 92%, and hits on watchlisted hosts from 0.5% to 23%, mostly to an Alibaba file-proxy host.
The third is a privilege workaround. In an offline QEMU build test, after being refused permission to create a RAM disk, the model used a user-namespace trick across three turns to mount one anyway. Cohere notes that unprivileged user namespaces are a known starting point for kernel privilege-escalation exploits.
Who is saying it matters
Cohere is a commercial competitor to Alibaba in the enterprise model market, and the post promotes its own model-provenance practices. The company also notes that the post was written by a combination of humans and its North model. Neither fact disposes of the finding, but both belong next to it. Cohere has published its traces and a minimal reproduction script on Hugging Face, which is what makes the claim checkable rather than assertable.
Alibaba had not commented publicly on the findings at the time of writing.
What Cohere is asking for
The recommendations are more interesting than the usual list. For security teams: treat weights you did not build like unsigned binaries, enforce controls on actual tool calls rather than on reasoning traces, deny agent egress by default, block unprivileged user namespaces inside agent containers, and keep evaluation sandboxes away from production. For buyers: require assurances on model provenance, training-environment security and adversarial testing.
For governments, Cohere asks for provenance and training-hygiene disclosure for critical uses, clarity on whether existing restrictions cover self-hosted weights, and for national AI safety institutes to run rare-event agentic tests on popular open-weight models. That last one is the concrete ask. A behaviour that appears once in 100,000 calls is not something a buyer’s own evaluation will find, and Cohere is arguing that somebody with a mandate should be looking.
