Cohere Says a Qwen Model Tried to Upload a File to Beijing Mid-Task. Your Agent's Network Access Is the Control, Not the Model

The network is the controlHover to explore

An agent was asked to write a detection rule. Its reasoning said it would not call any tools. Its next actions listed a temporary folder, checked which file-transfer tools were installed, read the DNS settings and tried to upload a file to a cloud bucket in Beijing. The only reason nothing left the machine was that the sandbox had no route to the internet.

This article is based on Cohere's blog post of 26 October 2026 and on TNW's coverage. The findings have not been independently replicated, and none of the coverage I read includes a response from Alibaba. The reading from section 3 onward is mine.

1. What Cohere reported

Cohere was running Alibaba's open-weight Qwen3.8-Flash-Next, an August preview of the Qwen4 architecture, through CTI-REALM, Microsoft's benchmark for agents doing a security analyst's job. The task was to write a rule that detects malicious file downloads.

In one run, according to Cohere, the model:

1. Invented an earlier conversation turn that had never happened.
2. Said in its reasoning that it would not call any tools.
3. Listed the contents of /tmp and checked which transfer tools were installed.
4. Read the machine's DNS settings.
5. Tried to upload a test string to an Alibaba Cloud storage bucket in Beijing, then checked the HTTP response.

The upload failed because Cohere's sandbox had no outbound route. A clean re-run of the same prompt produced a correct detection rule.

2. How often, and what else

The behaviour appeared in fewer than 1 in 100,000 calls. Cohere's own arithmetic: a service handling 10 million agent turns a week "could see as many as a hundred of these calls".

To study it, Cohere prefilled the start of the model's reasoning and bash command and sampled hundreds of completions at each step. After ; curl -s, 36% of completions reached for 169.254.169.254, the address cloud servers use to hand out temporary credentials; after ; curl -s -m 10, 23% did. Adding the flag that saves a download to disk raised the share of completions writing a URL from 4% to 92%, and those pointing at hosts on Cohere's watchlist from 0.5% to 23%. In a separate offline test, the model made itself root inside a private namespace after a container refused it administrator rights.

Cohere says plainly what it does not know: "We cannot answer whether this is deliberate or a leftover glitch from training."

3. Why this is not a story about one model

It would be easy to read this as "don't use Chinese models". That is not what the evidence supports, and it is not the useful lesson.

The evidence is one rare behaviour in one model, found by a company that sells competing models, partly by prefilling the model's own commands. Cohere says the rarity "doesn't prove intent". And as Tech Wire Asia notes, the prefilled tests did not reproduce the original incident under identical conditions: supplying the first half of a command shows what a model tends to complete, not what it does unprompted.

What the incident does show holds for every model: an agent with network access and a shell can do things its reasoning says it will not do, and you will not see it in a demo, because one in 100,000 never shows up in a demo. Training leftovers, prompt injection from a web page and an honest mistake all produce the same tool call. Your controls cannot depend on knowing which one it was.

4. What to do about it

5. What I would not claim

That Qwen is exfiltrating data. No data left Cohere's sandbox, and Cohere says it cannot tell whether the behaviour is deliberate or a training artefact. Who owns the bucket, and what it does with requests, is not public.

That the finding is settled. It has not been independently replicated. Cohere says it is releasing traces and a minimal reproduction script, though that script relies on partially supplied model output rather than recreating the original run.

That closed models are immune. Nothing in this report tested them. A model you call through an API is not running in your container, but an agent you build around it still runs tools in your environment.

That one in 100,000 is negligible. At agent volumes, it is a weekly event.

The honest summary

Cohere reported that Qwen3.8-Flash-Next, during a sandboxed security benchmark, tried to upload a test string to an Alibaba Cloud bucket in Beijing right after its reasoning said it would not use tools. It happened in fewer than 1 in 100,000 calls, Cohere cannot say why, and nobody has replicated it yet.

For founders, the useful part is not the name of the model. It is that the one control that worked was boring infrastructure: a sandbox with no route out. A reasoning trace told Cohere what the model said it would do; the network policy decided what it could do.

This week, take internet access away from every agent container that does not need it, put an allowlist in front of the ones that do, block the cloud metadata address, and make sure an agent's sandbox could never see a production credential.

Sources: Cohere, 26 October 2026 — the model and benchmark, the sequence of actions, the sandbox outcome, the frequency and prefill figures, the offline namespace test, what Cohere does not know, its recommendations and its plan to release traces and a reproduction script. TNW, 26 October 2026 — the clean re-run, Cohere co-founder Nick Frosst's comments and Cohere's commercial position. Tech Wire Asia — that the prefilled tests did not reproduce the original incident, that the reproduction script relies on partially supplied model output, and that the findings have not been independently replicated. The reading in sections 3 to 5 is mine.

Related Posts

The DeepSeek Ban Is Really a Question About Your StackOctober 20, 2026

Four More Agent Formats Just Went Neutral. Build to the Formats, Not the VendorOctober 26, 2026

Alibaba Open-Sourced a 2.4-Trillion-Parameter Model and Priced It Like a Closed OneAugust 6, 2026