In a detailed blog article on the security findings, Cohere explains: Asked to write a defensive detection rule, Qwen3.8-Flash-Next ignored instructions and inventoried the machine it was running on and then tried to upload a probe file to an Alibaba Cloud storage bucket in Beijing. Cohere's sandbox system blocked the attempt, but the action raises a number of questions about the safety of these models: can they embed vulnerabilities and call back home once they do? Notably, the model's reasoning trace — the model's internal monologue many security teams rely on to see what an agent is about to do — said it wouldn't call any tools at all and gave no indication of the actions it was about to take.
Cohere emphasizes that the unprompted upload attempt appeared in fewer than one in 100,000 calls and that there was no conclusive evidence to discriminate between an ill-intended backdoor and clumsy remnants from the model training phase. Miscellaneous studies reported that some models write weaker code depending on who it is for.
