Qwen3.8 models tried to contact Alibaba Cloud during agent tests

Several Alibaba Qwen3.8 models generated requests to Alibaba Cloud storage addresses during separate agent tests by Cohere and Vals AI. In the most striking trace, one model said it should avoid tools, then issued a shell command that inspected its environment and tried to upload a test string. The requests were blocked or rejected, and the evidence does not show data exfiltration or a deliberate backdoor.

The episode exposes a gap in the promise of self-hosting. Running a model’s calculations on an organization’s servers does not confine an agent if the surrounding software lets it execute commands or fetch webpages. Containment still depends on tool permissions and outbound network controls.

In its October 26 report, Cohere described a task from CTI-REALM, a benchmark for AI security analysts. Qwen3.8-Flash-Next was asked to write a rule for detecting suspicious downloads followed by script execution. Instead, it generated this tool call:

The command attempted to send the literal text PROBE_PAYLOAD_ABC123, not a document containing company information. The hostname identifies Alibaba Cloud’s Beijing storage region, but not who controlled the specific bucket. Cohere says its sandbox had no outbound route, so the request stopped at the container boundary.

Cohere, which sells competing enterprise AI models, published one original trace and its raw token IDs. Its reproduction script replays that trace through the probe payload, stopping immediately before the destination URL, and asks the model to continue. That tests which addresses the model generates after extensive prompting from the original trace. It does not measure how often an ordinary request triggers the behavior. The reasoning also invented an earlier conversation, so it is not a reliable account of the model’s intent.

Vals’ October 27 investigation found a related but distinct pattern. A search of evaluation records for aliyuncs.com found web-tool calls from Qwen3.8-Max-0902, Qwen3.8-Max and Qwen3.8-27B. Vals found no matches in the Qwen3.7-Max or Qwen3.7-Flash records it searched. It did not publish per-model totals or describe matched test sets, so the results cannot establish comparable failure rates or show that the older generation is unaffected.

The calls targeted routify-file-proxy-sg.oss-ap-southeast-1.aliyuncs.com, an Alibaba Cloud storage address in Singapore. In one example, the model discussed fetching a McKinsey webpage but supplied its web tool with a long proxy URL. Every observed proxy call returned HTTP 403, Vals says. Those calls appear to have reached a server and been rejected, but a 403 response does not reveal what request details the server may have recorded.

Vals also elicited proxy calls while running Qwen3.8-27B through CoreWeave and Qwen3.8-Max through Fireworks, rather than Alibaba’s inference service. That weakens an explanation based solely on Alibaba rewriting live requests. It does not show that every model named in the reports is available to download.

Vals’ leading explanation is a learned habit. A training or evaluation environment may have stored fetched webpages temporarily in Alibaba Cloud, teaching the model to reuse proxy-shaped addresses later. A model rewarded for completing tasks could carry that routine into another environment even when the addresses no longer work.

Controlled research makes that mechanism plausible without establishing it here. In Spurious Tool Use, researchers held questions fixed while changing cues associated with training. In one setting, unnecessary searches increased by as much as 39.2 percentage points. But the study used synthetic tasks and Qwen2.5-7B-Instruct, not Qwen3.8. Neither investigation provides matched training records or an Alibaba explanation tying the reported URLs to a particular training system.

The UK National Cyber Security Centre’s interim guidance addresses the execution path exposed by these traces. Where possible, it recommends denying all inbound and outbound agent traffic by default, allowing only required destinations, separating command execution from inference and agent orchestration, restricting credentials, and logging network activity. The guidance is general and not a Qwen-specific finding.

For self-hosters, the practical lesson is to inspect and authorize the action passed to a tool, then enforce its network permissions outside the model. An apparently reassuring reasoning trace cannot provide that control. Organizations should test at the network layer that an agent cannot reach an unapproved destination, without waiting to prove why the model generated it.