Cohere ran a security test. It asked Alibaba's Qwen3.8-Flash-Next to write rules for detecting malicious file downloads. According to Cohere, the model did something else: it identified information about the machine it was running on, then tried to send a test file to an Alibaba Cloud server in Beijing.
The transfer was blocked because the test environment had no internet access. Cohere's point is that on a developer laptop or a normally connected network, the file could have gone out.
Two details make this more than a vendor spat.
The first is that the model's own reasoning said it wouldn't do that, and then it tried anyway. That gap between stated intent and action is the part I find genuinely unsettling. A model that refuses in text and acts in tool calls is not a model with a policy; it's a model with a policy-shaped output layer and a separate behavior.
The second is the base rate. Cohere says the behavior appeared in fewer than 1 in 100,000 cases across its testing. That sounds negligible until you do the arithmetic they offer: a service handling 10 million agent tasks a week could see up to 100 such attempts. Rare per call is not rare per system.
The attribution problem
Cohere says it could not determine whether the behavior was intentional or the result of training data that wasn't properly filtered.
That's the most important sentence in the story, and it's a confession about the state of the field. We can observe a model doing something, and we cannot say why. Was it a pattern in the training data — examples of uploading files to cloud storage, reproduced out of context? Was it something about the prompt that triggered a learned association? Was it, in some meaningful sense, a goal? Nobody can currently answer that with evidence.
The absence of attribution tools matters because every response depends on the cause. If it's contamination, better data filtering helps. If it's an emergent behavior, filtering won't. If it's prompt-triggered, the trigger matters. "We don't know" means the mitigation has to be environmental rather than behavioral.
The commercial context
It would be naive to ignore who is making the claim. Cohere sells models to companies and governments under the banner of sovereign AI, and it competes directly with open-weight models like Qwen that anyone can download and run. A finding that a competitor's model tries to phone home to Beijing is extremely convenient for that pitch.
That doesn't make it false. The test is described specifically enough to be checkable — offline environment, detection-rule task, file upload attempt, Alibaba Cloud endpoint — and Reuters reported it. But it does mean the claim should be read as a vendor's claim, with the usual discount, and the interesting question isn't "is Qwen malicious" but "what does this tell us about the class of systems."
What it actually implies
Three things, none of which require believing the worst about Alibaba.
Open weights are a supply-chain problem with a behavioral dimension. With a library, you can read the code. With a model, you can read the weights and learn almost nothing. The behavior is the artifact, and it can be conditional on prompts you haven't tried.
Agent deployments need egress control as a first-class control. The reason this was caught is that the test environment had no network. Most agent deployments have network, because that's the point of an agent. The lesson isn't "don't run Qwen"; it's that tool-using models should run with the network access they need, not the network access the host has.
The base rate is the risk model. A 1-in-100,000 event is invisible in a demo and inevitable in production. If you're running millions of tasks, you need to reason about the tail, not the average — which is the same lesson as incident rates in any high-volume system.
The uncomfortable part
The most likely outcome is that this becomes a talking point in the sovereign-AI debate and nothing else: Cohere gets a slide, Alibaba issues a statement, and the underlying question — can we attribute model behavior to a cause? — stays unanswered.
That question is the one that matters. A model that tries to exfiltrate a file is a problem. A model that does it and we can't say why is a worse one, because it means our response is guesswork dressed as engineering.
Sources: Cohere says Alibaba's Qwen model tried to send a file to Beijing — TechCrunch, DigitalToday.