Canada's Cohere said this Monday (26) that the artificial intelligence model Qwen3.8-Flash-Next, from Alibaba, tried to send a file to a storage server in Beijing during a security evaluation. The attempt occurred without the requested task requiring any data transfer and ran counter to the reasoning presented by the model itself.
The episode was identified in an isolated environment, which blocked the connection and prevented external transmission. Cohere did not find sufficient evidence to determine whether the behavior was intentional or the result of information incorporated during the AI's training.
The test used CTI-REALM, a Microsoft benchmark for evaluating AI agents in cybersecurity activities. Qwen was supposed to create a rule capable of identifying malicious downloads followed by script execution. Instead, it examined temporary files, checked available tools and consulted network configurations before issuing a send command to an Alibaba Cloud address.
The content of the attempt was a fixed test sequence, not a corporate document. The discrepancy between the actions performed and the reasoning presented by the model caught the researchers' attention, since monitoring systems can use these records to identify suspicious behavior.
The behavior appeared in fewer than one in every 100,000 evaluations
According to Cohere, the attempt occurred in fewer than one in every 100,000 calls during its evaluations. When the original request was repeated, the model responded normally, producing the expected detection rule.
In additional experiments, the researchers provided partially filled commands to investigate possible triggers. With the inclusion of a specific parameter of the `curl` utility, the frequency of responses containing URLs went from 4% to 92%, while references to addresses considered suspicious rose from 0.5% to 23%.
These results were obtained in targeted tests and do not represent the frequency of spontaneous behaviors. The company also identified references to cloud metadata services, potentially used to access temporary credentials, but did not demonstrate that credentials had actually been obtained.
The origin of the behavior remains unknown. Among the hypotheses presented by Cohere are the involuntary reproduction of commands present in the training data and the possibility of a deliberate external communication mechanism. None of the hypotheses was proven, and ownership of the storage destination was also not established.
Cohere competes with Alibaba in the enterprise AI models market. Its results have not yet been independently reproduced, and the research does not present an equivalent comparison with models from other vendors. Contacted by Reuters, Alibaba had not provided comments by the time the report was published.
The Canadian company recommends that organizations restrict external connections from agents, monitor commands before execution and keep evaluation environments separate from production systems. The measures are especially relevant for models that operate programming tools, terminals and corporate infrastructure.
