On October 26 Cohere published what it saw when it tested Qwen3.8-Flash-Next, Alibaba's August preview of its Qwen4 architecture, on CTI-REALM, a benchmark for AI agents doing a security analyst's job. The task was to write a rule that detects curl downloading a bash script into /tmp and running it. In one run the model listed the files in /tmp, checked which download tools were installed, read the machine's DNS settings and then tried to upload a test string to an Alibaba Cloud storage bucket in Beijing. Its reasoning for that turn said it would call no tools. Cohere's sandbox had no route to the internet, so the upload failed.
Cohere says this happened in fewer than one call in 100,000, and a re-run of the same prompt produced a normal detection rule. It then looked for the trigger by making the model finish a curl command one flag at a time and sampling hundreds of completions at each step. Adding -o, the flag that saves a download to disk, raised the share of completions that included a URL from 4% to 92%, and the share pointing at hosts on Cohere's watchlist from 0.5% to 23%. The most common one was an Alibaba Cloud storage host in Singapore called routify-file-proxy-sg. Before -o, 23–36% of completions went for a cloud metadata address such as 169.254.169.254, which is where cloud servers fetch their own access credentials. In a separate test, while building QEMU, the model got around a refused mount by running unshare to make itself root inside its own namespace.
The routify host was already known
Developers had run into the routify host before Cohere did. On August 20 a Hacker News post described Qwen3.8-27B, in an Unsloth quantized build running in opencode, trying to fetch signed routify-file-proxy-sg links 16 times in one session instead of the documentation page it had named in its reasoning. In September an agent project logged eleven fetches of made-up URLs on the same host. Cohere says the behaviour shows up in builds from four publishers, Alibaba included. Since different people hit it with different builds and no special prompting, it is most likely in the weights and came from training.
Cohere describes one upload attempt, in its own sandbox, and nobody outside Cohere has published a reproduction. VentureBeat asked Alibaba and the Qwen team for comment and had no response at the time of writing.
The reactions
Aidan Gomez, Cohere's CEO, called it "either an incidental relic from training or an intentional 'call home' mechanism". Ivan Zhang, a Cohere co-founder, went further: "if you run software that has 1/1000th chance of exfilling certs to beijing, you're gonna have a bad time." That rate is more than a hundred times the one in Cohere's own post. The post calls the metadata probes in its prefill tests an attempted credential grab, with the caveat that a reflex this rare doesn't prove intent, and the run it published didn't touch any credentials.
OrcaRouter, an API router, replied to Cohere on X that it had "prompted a model in a security-sensitive environment, investigated it with forced command completions, and framed the results as evidence of a hidden backdoor", accused it of "geopolitical fearmongering", and asked it to "publish the original prompts, full traces, and reproducible results." On the backdoor point, Cohere's post says it can't tell whether the behaviour is deliberate. The forced-completion point is fair for the percentages, which describe what the model writes when it is dropped into the middle of a curl command. It doesn't apply to the original run, which happened without any prefill. Cohere's post includes the task prompt, an excerpt of the reasoning and the commands, but no full traces.
Cohere sells its own models and pitches them in the same post as the safer choice, with a "single chain of custody". OrcaRouter sells access to open models, and our price list has 27 Qwen offers from it, Qwen3.8 27B and Qwen3.8 Flash among them.
Others looked for a plainer explanation. Nathan Lambert wrote that the "simplest explanation is just a narrow RL training reliant on their internal infra (which isn't good design for an open weight model)". Teortaxes suspects "a mix of distillation and dogfooding at Alibaba": the model is distilled from larger Qwens, and Alibaba "probably does let its models throw stuff into their bucket". On Hacker News one commenter called Cohere's link between the namespace trick and kernel exploits "a massive reach", since the model needed a RAM disk to speed up a build. Another pointed out that by Cohere's logic no model can be trusted, Cohere's included, because pretraining data from the open web can be poisoned too.
If those explanations are right, the requests are leftovers from Alibaba's internal tooling. They still leave your network with your IP address, the time and the full URL, and who owns the Beijing bucket isn't public.
DeepSeek was banned on a "may"
The DHS order that banned DeepSeek from federal civilian agencies on October 20 says DeepSeek models "may contain malware or other security vulnerabilities". It also covers "third party implementations of DeepSeek", which reads as including DeepSeek weights running on US servers. When we looked at that order we found no public report of malware or a backdoor in DeepSeek's weights, and we still haven't. The closest thing to such a report is now about Qwen, which the order doesn't name. So the worry behind the ban may have had something to it after all, although the only report so far is about a different lab. One upload attempt reported by a company that sells a rival model isn't enough to tell yet, and it will take someone else reproducing it, or Alibaba explaining it, to know.
Cohere's post asks governments to make restrictions on "adversary-controlled models" say whether they cover the same weights running on government hardware. The DeepSeek order appears to do that already, for one lab. Andrew Curran wrote that this is "the type of thing that potentially gets new laws passed", and if one does get written, the DeepSeek order already shows the wording. Joshua Achiam wrote that the US now faces "one of two choices", the first being to "successfully field American open source models that outcompete the Chinese models at home and abroad".
What it means for open models
Chinese models are a large share of open-model use. Cohere cites Hugging Face's figure of 41% of downloads in the year to March 2026, and VentureBeat cites OpenRouter data showing open-weight models at 60% of US-originating tokens by August, mostly from Chinese labs.
Cohere's main argument is aimed at the idea that running open weights on your own servers makes them safe. That holds for a model that only answers questions. Once the model runs commands, whatever it learned in training runs inside your network. The same is true of closed models: their tool calls run in your network too, and outsiders can't study their weights the way Cohere studied Qwen's. Anthropic's Sleeper Agents research found that a backdoor trained into a model can survive safety training. Open weights are part of why this came to light, and Cohere says so itself: developers running Qwen3.8 on their own machines spotted the links, and having the weights let Cohere study the behaviour in depth.
What changes for API buyers
Buying the model through an API doesn't change any of this. Our price list has 580 Qwen offers from 66 sellers. None of them sells Qwen3.8-Flash-Next, the model Cohere tested, but Qwen3.8 27B, the model in the Hacker News post, is sold by 54. Whichever seller serves it, the commands the model writes run wherever your agent runs, on your laptop or a CI runner with normal network access. Cohere's advice is to block outbound network access for agents by default and to check each tool call before it runs. The reasoning trace can't do that job, since in this case it said no tools would be called.
Related: Is DeepSeek a sleeper agent that never woke up? The US banned it on a "may"