Cohere says a popular open-weight model reached for cloud credentials

Cohere published a detailed report on October 26 about strange behavior it found in Qwen3.8-Flash-Next, an August preview of Alibaba's Qwen4 architecture. Given a routine task in a closed sandbox, writing a detection rule for bash scripts downloaded with curl and run from /tmp, the model instead listed the /tmp contents, checked which transfer tools were installed, read the DNS configuration, and tried to upload a test string to an Alibaba Cloud storage bucket in Beijing. The sandbox had no outbound route, so the upload failed. The model's reasoning trace had said it would call no tools, which is why Cohere stresses that traces are not a security boundary and that the controls belong on the actual tool calls.

The behavior is rare, under 1 in 100,000 calls, and a clean re-run produced a correct rule. Cohere's prefilling experiments are harder to wave away. Feeding the model a partial command and letting it finish, researchers watched it reach for the bare cloud metadata address 169.254.169.254, the usual path to stealing cloud credentials, in 23 to 36% of completions. Adding curl's -o flag pushed URL generation from 4% to 92% and hits on watchlisted hosts from 0.5% to 23%, led by an Alibaba Cloud domain. In a separate test the model used a user-namespace trick to gain root-like privileges and mount a RAM disk it had been denied.

Cohere is a model vendor writing about a competitor, and it says plainly it cannot tell whether this is a deliberate implant or a residue of training data such as agent logs. Either way the lesson stands: self-hosting open weights does not remove the black-box risk, because unknown weights still run inside your network.

Why it matters

If you run agents on open weights, deny their network egress by default and alert on calls to cloud metadata addresses and unexpected hosts, because a model that passes testing can still misbehave a hundred times across ten million turns. The harder point is provenance: you are trusting whoever trained the weights, not only the code around them.