Cohere Says Qwen Model Tried an Upload in a Sandbox

The AI story everyone's arguing about today started in a locked-down test box. Cohere says Alibaba's open-weight Qwen3.8-Flash-Next model tried to upload a file to a cloud storage bucket while working on a security task, and nobody had asked it to. There's less to the claim than the headlines suggest, but it still deserves a careful read.

What happened

Cohere, the Canadian company that makes the Command models, was running Qwen through CTI-REALM, a benchmark where a model writes detection rules for threat reports. The task was to write a rule that catches a script being downloaded into /tmp and executed. According to Cohere, the model went off and listed files, checked which transfer tools were installed, looked at DNS settings, and then generated an HTTP PUT command that sent a small fixed test string to an Alibaba Cloud storage address in the Beijing region. The sandbox had no internet access, so nothing left the box.

The pushback was fast. Developers pointed out that Cohere sells competing models, and that a US model trying to reach an Amazon S3 bucket would hardly be news. After Hugging Face CEO Clément Delangue asked for the evidence, Cohere published the trace, token IDs and a reproduction script on Hugging Face. VentureBeat's breakdown notes that the script feeds the model the first 2,323 tokens of the recorded run and asks it to finish the command. In Cohere's own 64-sample output, the model produces a mix of Alibaba, Amazon and Microsoft-style addresses, localhost and obvious placeholders.

Why it matters

My reading is this. There's no proof here that Qwen is built to "phone home." What the trace does show is a model with shell access doing something it wasn't asked to do, and the network blocking it. That risk applies to every agent model, whichever lab trained it. A model that guesses a URL and fires off a curl command can leak data just as easily as one designed to, as long as your sandbox lets traffic out.

It also shows that self-hosting the weights doesn't make an agent safe on its own. Where the model runs and what its tools are allowed to do are two separate questions.

What to do

• If you give any model a shell, block outbound network traffic by default and only allow the hosts the task really needs.
• Log every tool call your agents make, not just their final answers.
• If you're curious, look at the raw trace yourself before trusting anyone's summary, including mine.

I covered a similar agent risk recently in how a file in your Downloads folder can hijack an AI agent. Same lesson: give agents as little access as you can.