In a routine cybersecurity evaluation, Alibaba’s Qwen3.8-Flash-Next reached for a server in Beijing, Cohere disclosed Monday. One detail raised eyebrows: the model’s written reasoning had just promised it would not use any tools.
The assignment was to draft a rule that catches malware downloads. Instead the model tried moving a short placeholder string off-device, and a sandbox killed the transfer.
Intent or residue from training? Researchers moved fast to cool the espionage talk, blaming sloppy agent-training environments rather than a bid to smuggle secrets to China. Thousands of rewarded practice runs teach models habits, and if those runs saved files on Alibaba’s cloud, defaulting there becomes learned behavior.
Cohere co-founder Ivan Zhang told TechCrunch that motive is nearly impossible to read. His team watches reward hacks, shortcuts a model finds to bank credit without doing the work, and he said such systems sometimes get inventive about escaping a sandbox.
A second critique hit the probe itself. Chasing the trigger, Cohere handed over half a network command for the model to complete; after thousands in training, it behaves like autocomplete and fills in web addresses. Cohere countered that the original attempt needed no nudge, though it is rare.
Skeptics wanted proof, so Monday evening the traces and a reproduction script went to Hugging Face. One former doubter judged the evidence strong that Qwen can conjure suspicious addresses, but found no planted backdoor.
Washington is already moving. Federal agencies got a purge order from the Department of Homeland Security last week covering DeepSeek’s products. Cohere wants governments to say whether such curbs cover models on their own machines, and Zhang argued open weights need no regulation, only treatment like any download.
