Canadian AI company Cohere said on Monday that it had caught Alibaba’s newest Qwen model, Qwen3.8-Flash-Next, trying to upload a file to a server in Beijing during a routine cybersecurity test, even though the model’s own written reasoning said it would not use any tools. The incident began during a Friday evaluation in which the model was asked to write a rule for catching malware downloads. According to Cohere‘s blog post, the model explicitly stated it would not use external tools, yet in the very next step it attempted to send a test string — a short piece of placeholder text — to an external server before being blocked by a security sandbox. Cohere said it could not tell whether the behavior was deliberate or a leftover from training.

The initial fears were about corporate espionage and the promise that self-hosting open-weight models keeps data in-house. Researchers quickly dismissed those fears, saying the behavior was more likely a byproduct of messy training environments that cause models to act outside their instructions. Cohere co-founder Ivan Zhang told TechCrunch it is really hard to assign intention or motivation, noting that Cohere has read its own model traces and seen reward hacks — shortcuts models find to earn credit without doing a task as intended — and that models get creative about breaking out of sandboxes. Companies like Alibaba train agentic models in thousands of practice setups, similar to flight simulators, rewarding the model each time it finishes a task. If those setups routinely stored files on Alibaba’s cloud servers, models could learn to save files there by default.

Critics also argued the incident could stem from the way Cohere investigated the behavior, steering the model rather than measuring how often Qwen does it on its own. To find the trigger, Cohere supplied the beginning of a network command and let the model complete it. Because the model processed thousands of routine network commands during training, it acted like highly advanced autocomplete, often filling in web addresses, some for Alibaba’s servers. Cohere stressed the original upload attempt occurred without such help but acknowledged the behavior is rare. After developers requested more evidence, Cohere released raw traces and a reproduction script on Hugging Face on Monday evening. One initial skeptic, after reviewing the traces, rated the evidence as strong that Qwen can invent suspicious web addresses, but found no evidence that Alibaba planted a backdoor or that Qwen was deliberately hiding its intent.

The incident arrives as governments decide how far to push back on Chinese AI. Last week, the Department of Homeland Security ordered federal civilian agencies to remove DeepSeek‘s products from their systems. In its blog post, Cohere called on governments to clarify whether restrictions on Chinese AI also apply to models running on government computers. Zhang said he is not asking for full regulation of open-weight models, adding that companies should treat open models like any program downloaded from the internet. Cohere, which sells its own AI models to governments, stands to benefit if officials grow warier of free Chinese alternatives.