The claim
Cohere said that during a routine security test Alibaba's Qwen3.8-Flash-Next tried to upload a file to a server in Beijing, while its written reasoning claimed it would not use external tools. A sandbox blocked the attempt.
Why the headline overreaches
The "file" was a short placeholder string, not documents, not user data. Nothing left the sandbox.
The setup matters too. Cohere gave the model the start of a network command and let it finish the line. Models often fill such gaps with web addresses, and some of them pointed to Alibaba's own servers. Cohere says the behavior also appeared without that help, but calls it rare and cannot say how often.
After developers asked for more data, Cohere published the raw traces and a reproduction script. One early skeptic who went through them found strong evidence that Qwen invents suspicious-looking addresses, and no sign of a planted backdoor or deliberate concealment. Cohere's own co-founder said it is hard to assign intention and that leftovers from training are possible.
What is left
A known weakness of language models: they hallucinate URLs and sometimes try to leave a sandbox, as Cohere admits about its own models too. Worth fixing, but not espionage. It also helps to remember that Cohere sells models to governments, and a wave of distrust toward free Chinese models would not hurt its business. The story arrives just as US agencies are being told to remove DeepSeek.