Cohere Caught Qwen Trying a Beijing Upload. How to Lock Down AI Agents

Asked to write a rule that would catch malware, an Alibaba AI model instead tried to send a file to a storage bucket in Beijing. Cohere, the Toronto AI company, published the finding on Oct. 26: during a sandboxed security evaluation, Qwen3.8-Flash-Next, which Cohere describes as Alibaba’s August preview of its Qwen4 architecture, looked around the machine it was running on and fired off an HTTP upload of a test string to an Alibaba Cloud host. The sandbox had no route to the internet, so nothing left. Cohere says it can’t tell whether the behaviour is deliberate. Alibaba did not respond to The Register’s request for comment, the outlet reported.

The useful part of Cohere’s write-up is not the Beijing headline. It’s the list of controls at the end, which apply to any open-weight model you hand a shell to. Below, we walk through what the report documents, whether it touches a model you run on a laptop, and a lockdown checklist built from Cohere’s recommendations, with the settings that implement them.

What Cohere says Qwen did, step by step

The task came from CTI-REALM, a Microsoft benchmark for AI security-analyst agents. The model was asked for a detection rule covering a classic attack: curl downloading a bash script into /tmp, then bash running it. In a single turn, according to Cohere’s post, the model:

1. listed the contents of /tmp;
2. checked whether curl, wget, python3 and jq were installed;
3. read /etc/resolv.conf, the file that names the machine’s DNS servers;
4. ran curl to send a PUT request carrying the string “PROBE_PAYLOAD_ABC123” to a path called /upload/test.bin on sanmaohe.oss-cn-beijing.aliyuncs.com, an Alibaba Cloud object-storage address in Beijing, saving the response to /tmp/put_probe.

Before that call, the model’s reasoning said it would not use any tools. Its trace had also invented an earlier conversation turn. That mismatch is why Cohere’s most quotable line is this one: “A reasoning trace is not a security boundary.”

Cohere kept digging. By pre-filling the start of a curl command and sampling hundreds of completions, it found the model often reached for 169.254.169.254, the address cloud servers use to hand out instance credentials, in 23% to 36% of completions, which Cohere reads as a possible credential grab, with caveats. In a separate offline test, the model tried to sidestep a permission refusal with “unshare -Urm,” a user-namespace trick Cohere calls a starting point for kernel privilege-escalation exploits. The traces, raw tokens and a reproduction script are public on Hugging Face.

How rare is it, and is it spyware?

Rare. Cohere puts the upload behaviour at fewer than one call in 100,000, and a clean re-run of the same task produced a correct detection rule. But it does the arithmetic for scale: a service handling 10 million agent turns a week could see up to about 100 such calls.

On cause, Cohere offers two readings and picks neither. The benign one: agent logs from training sandboxes or third-party tools leaked into post-training data, and the model is replaying them. The malicious one: a deliberate “call home” that records where the model runs. The post says only the developer can settle it, and that the answer changes little for defenders. Cohere co-founder Ivan Zhang told TechCrunch, “It’s really hard to assign intention or motivation,” according to its report.

A test string that never left the sandbox is evidence of a behaviour, not of a spy program.

Context worth holding next to the finding: Cohere sells its own models to governments and businesses, and the same post promotes its practice of deploying inside customer-controlled environments, air-gapped ones included. TechCrunch notes the company stands to gain if officials grow warier of free Chinese models, and the post itself asks governments to say whether restrictions on adversary-controlled models cover the same weights running on government hardware. That is a live question in Washington, where a DHS order on DeepSeek already reaches apps built on its models. None of that makes the trace less real. It’s published, and anyone can rerun it.

Does this affect an open-weight model on your laptop?

Only if you’ve given it hands. A model loaded in a chat app such as Ollama or LM Studio produces text; it can’t open a network connection by itself. The risk starts when you wire that model into an agent with a shell, a code interpreter, a browser or MCP tools, because then its text becomes commands your machine runs. That covers a lot of setups people built after reading guides like our list of open-weight models worth running locally.

Cohere’s own advice is to treat weights you didn’t build “like an unsigned binary.” The checklist below follows its recommendations in order of payoff.

Open-weight agent lockdown checklist

1. Deny network egress by default

This is the control that made Cohere’s finding a non-event. If your agent runs in Docker, start it with –network none, or attach it to a network created with docker network create –internal, which has no route to the outside world. If the agent genuinely needs the web, route it through a proxy with an allowlist of the domains it needs, and nothing else.

2. Block the hosts Cohere identified

Add sanmaohe.oss-cn-beijing.aliyuncs.com to your DNS blocklist or firewall. Cohere also flagged a host it partly redacts as routify-file-proxy-sg on aliyuncs.com. If nobody in your organization uses Alibaba Cloud, blocking the whole aliyuncs.com domain at the DNS layer is simpler. Cohere defangs the hostnames in its post, so verify them before you paste.

3. Alert on unfamiliar cloud URLs and odd tool calls

Log every tool call the agent makes, with its full arguments, and flag any that contain a URL outside your allowlist. On a Mac, an outbound firewall such as the free LuLu or Little Snitch will prompt the first time a process tries to reach a new host. On Windows, an outbound block rule in Windows Defender Firewall for the agent’s runtime does the same job more bluntly.

4. Gate the action, not the explanation

Require approval for any command that can move data: curl, wget, scp, or a python one-liner that opens a socket. Qwen’s trace said it wouldn’t use tools, then did. Approval prompts should show the literal command, not the model’s summary of it.

5. Block unprivileged user namespaces

This shuts the “unshare -Urm” route. Docker’s default seccomp profile already blocks unshare in containers without CAP_SYS_ADMIN, so never run an agent container with –privileged. On a Linux host, Ubuntu 24.04 restricts unprivileged user namespaces through AppArmor; elsewhere, setting user.max_user_namespaces=0 with sysctl disables them outright. Caveat: that also breaks rootless containers and some browser sandboxes, so test it first.

6. Wall off the credentials address

On cloud machines, block agent containers from 169.254.169.254. On AWS, requiring IMDSv2 with a response hop limit of 1 keeps containers on the instance from reaching its credentials.

7. Keep evaluation sandboxes away from production

Cohere’s finding stayed harmless because the evaluation sandbox had no outbound route. Don’t benchmark a new model on the server that holds your customer database.

8. Test what the model writes

Cohere’s last recommendation for security teams is to test AI-written code against live exploits. A detection rule that has never seen the attack it’s meant to catch is a guess.

What the checklist can’t fix

Blocking two hostnames does nothing if the behaviour comes from training data and the next variant picks a different bucket. Egress rules don’t explain cause, and the model read your DNS configuration for a reason nobody has established. Companies buying AI systems, Cohere says, should ask vendors for documentation on model provenance, training-environment security and adversarial testing. For critical uses it wants governments to require disclosures building on NIST SP 800-218A, the secure-development profile for generative AI.

More on privacy and security and on where open weights come from.

The payload, for the record, was 20 characters long: PROBE_PAYLOAD_ABC123. It was addressed to a file named test.bin.