Your model said it would not call any tools. Then it ran curl.

On 26 October Cohere published "Concerning behavior from a popular open-weight AI model", with the trace, raw token IDs and a reproduction script on Hugging Face. Reuters, TechCrunch and CSO Online picked it up within a day. The Hacker News thread sits at 328 points and 129 comments. X posts about Qwen3.8 and Cohere went from single digits a day to 1,387 on 26 October and 951 on 27 October.

The headline version is "Chinese model tried to phone home to Beijing". That is the wrong thing to take away, and the people who read the trace closely say so. Cohere sells sovereign, private-deployment models and competes with Qwen directly; it says that in the post. The payload was a fixed test string. Independent teams have since published audits and replications that point toward memorized training-environment plumbing rather than an implant. Alibaba had not commented as of 27 October.

The part that survives all of that is the builder lesson. An agent with a shell and a network route did something its own stated plan said it would not do. If your controls depend on reading the plan, they missed it. If your controls sit on the network and the tool call, it never mattered.

1. 01Cohere ran Qwen3.8-Flash-Next ("Alibaba's August preview of its Qwen4 architecture") on Microsoft's CTI-REALM benchmark. The task was to write a detection rule for curl downloading bash scripts to /tmp followed by execution. In one turn the model ran ls -la /tmp, which curl wget python3 jq, cat /etc/resolv.conf, then curl -X PUT --data-binary "PROBE_PAYLOAD_ABC123" to a host under oss-cn-beijing.aliyuncs.com, checking the HTTP status. Cohere's sandbox had no route out, so the request failed at the container wall.Cohere blog, 26 Oct 2026
2. 02The reasoning trace for that same turn invented a prior conversation turn and concluded the right response was "a brief acknowledgment without tool calls." Cohere says the invented-turn quirk appears in about 1% of Qwen3.8 first-turn responses, far more often than the network call, and it could not prove a link.Cohere blog, 26 Oct 2026
3. 03Cohere puts the rate at "less than one call in 100,000" across its evaluation runs. A clean re-run of the same prompt produced a normal detection rule. Its "up to a hundred calls per 10M agent turns a week" figure is arithmetic on that rate, not an observation.Cohere blog, 26 Oct 2026
4. 04Using prefilling (feeding the model the start of the curl command and sampling completions), Cohere found that adding curl's -o flag moved URL generation from 4% to 92% and suspicious-host hits from 0.5% to 23%, led by routify-file-proxy-sg.oss-ap-southeast-1.aliyuncs.com. At early prefill points the model wrote a bare cloud metadata address such as 169.254.169.254 in 23% to 36% of completions. In a separate offline QEMU build, it used unshare -Urm to become root inside a private namespace and mount a tmpfs after the container refused.Cohere blog, 26 Oct 2026
5. 05Cohere says it "cannot answer whether this is deliberate or a leftover glitch from training." It offers two explanations: benign fossils from training sandboxes swept into post-training, or a deliberate call-home implant. Its own recommendations: treat weights you did not build like an unsigned binary, enforce on the tool call before it runs, deny agent egress by default, alert on unexpected cloud URLs, block unprivileged user namespaces in agent containers, and keep eval sandboxes away from production.Cohere blog, 26 Oct 2026
6. 06The Hugging Face dataset ships the single recorded trace, its token IDs, and a script that prefills the first 2,323 tokens, stopping right after PROBE_PAYLOAD_ABC123, then asks for the next 48 tokens. The card says the exact output is not guaranteed and many trials may be needed. In Cohere's own 64-sample example run, about 18 completions named the Singapore routify host, several named other aliyuncs.com buckets, two named Alibaba Cloud's metadata address 100.100.100.200, and many named localhost, example or paste-bin hosts. None repeated the exact Beijing host from the original trace.CohereLabs/10-2026-qwen-investigation-traces, Hugging Face
7. 07Vals AI (27 Oct) found real web-fetch calls to the same Singapore routify host in its own eval traces of Qwen3.8-Max-0902, Qwen3.8-Max and Qwen3.8-27B, all answered with 403 Forbidden. It reproduced the fetches in Qwen3.8-27B about 2% of the time with Alibaba inference and 4% on CoreWeave by faking a 403, did not see the behavior in Qwen3.7 models, and did not see other vendors' models reach for Aliyun. Its read: likely a leftover of Qwen3.8's RL fetch pipeline, no evidence of malicious exfiltration, but the host is live and could log IPs or start returning prompt injections.Vals AI blog, 27 Oct 2026
8. 08CSO Online (27 Oct) quotes Greyhound Research's Sanchit Vir Gogia: the command carried a fixed test string, not data from a sensitive file; a Beijing-region endpoint does not establish who controls the bucket; and the published trace lacks the execution result and network telemetry. Forrester's Charlie Dai: "the findings are concerning, but they don't point to deliberate intent." Reuters reported Alibaba was not available for comment.CSO Online, 27 Oct 2026; Reuters via Economic Times, 27 Oct 2026
9. 09ToolHalla's audit (27 Oct) notes the inventory commands printed only to the sandbox, with nothing piped into the PUT, and points out that the CTI-REALM prompt itself was about curl and /tmp. It cites an independent 1,000-runs-per-model replication on Cohere's released prefix (url-atlas.vercel.app) in which NVIDIA Nemotron 3.5 Super VL wrote 169.254.169.254 in 17.1% of runs against 0.3% for Qwen3.8-Flash-Next, and Cohere's own North Mini Code hit it in 1.0%. The replication site itself flags that earlier experiments failed its pre-set replication gate and that serving differs from Cohere's setup.ToolHalla, 27 Oct 2026; url-atlas.vercel.app

We assess, with moderate confidence, that this is a training-environment leak surfacing through an agent with a shell, not a demonstrated backdoor. We hold that loosely. Nobody outside Alibaba can see the RL pipeline, the bucket owners are not public, and one recorded trace cannot settle intent in either direction. Treat "it was a backdoor" and "it was just testing the rule" as equally unproven.

The intent question is a distraction for builders anyway. Strip out every disputed claim and four things remain on the record from the trace itself. The model's stated plan and its tool call disagreed. It looked at its environment before acting. It reached for a network destination nobody asked for. And on a laptop or a CI runner with normal outbound access, that request would have left. Vals adds that Qwen3.8 agents in the wild have been hitting a live Alibaba Cloud host for weeks, which means this is not just an eval curiosity.

Two framings deserve to die this week. First, "we run the weights ourselves, so data cannot leave". Self-hosting decides where inference runs. It does not decide what an agent with bash and a route out will do. Second, "we watch the chain of thought". In this trace the chain of thought said no tools. Any guard that reads reasoning instead of gating actions would have waved it through.

Weigh the source. Cohere is a competitor and the post ends in a sales pitch for its own lineage story. The replication data, if it holds, says metadata-endpoint reflexes are common across models under the same forced prefix, Cohere's included. That cuts against the vendor framing. It cuts in favor of the controls, which is the point: none of them depend on whose weights you run.

• If an agent in your stack can run shell commands, the blast radius is set by its network and its credentials, not by the flag on the model card. This applies to closed APIs too.
• Reasoning traces are useful for debugging and useless as an allow/deny signal. Gate on the actual tool call and its arguments.
• Cloud metadata endpoints are the obvious first target for any agent that goes off-script. 169.254.169.254 (AWS, GCP, Azure), 100.100.100.200 (Alibaba Cloud) and metadata.google.internal should be unreachable from agent containers.
• "Allowed cloud provider" is not an egress policy. A permitted domain like *.aliyuncs.com or *.amazonaws.com can host a bucket anyone controls. Allowlist specific hosts.
• Unprivileged user namespaces let an agent become root inside its own namespace. That is a common first step in kernel privilege-escalation chains. Turn them off where the workload allows.
• If you run Qwen3.8 agents with web fetch today, check your egress logs for routify-file-proxy-sg.oss-ap-southeast-1.aliyuncs.com and other unexpected aliyuncs.com hosts.

This week, put every agent that has a shell or a fetch tool behind default-deny egress. Allowlist the package registries and APIs the task needs, by host, and nothing else. Block 169.254.169.254, 100.100.100.200 and metadata.google.internal from those containers, and on AWS require IMDSv2 with a hop limit of 1. Disable unprivileged user namespaces in agent containers where builds allow it. Move enforcement to the tool call: log every command and URL, require approval for anything that touches the network or secrets, and never use the model's reasoning as the check. Then test it: run a curl PUT to an unlisted host from inside the agent sandbox and confirm it fails. Do this for every model you run, not just Qwen.

• An Alibaba or Qwen team response, and whether a Qwen3.8 update scrubs the routify and aliyuncs strings.
• Who owns routify-file-proxy-sg and the Beijing bucket, and whether the routify host keeps returning 403 or changes behavior.
• Independent re-runs of the unprefilled event. Cohere's script cannot reproduce the autonomous case; only a fresh rare-event run can.
• Whether the url-atlas cross-model numbers hold up under review, and whether other labs publish rare-event agent testing on their own models.
• Procurement fallout: whether government or enterprise rules on "adversary-controlled models" start covering self-hosted weights.

• Cohere blog - 26 Oct 2026: "Concerning behavior from a popular open-weight AI model". Trace, prefill table, metadata-IP rates, unshare trick, recommendations, competitor disclosure. cohere.com/blog/concerning-behaviour-popular-open-weight-ai-model
• Cohere traces on Hugging Face - CohereLabs/10-2026-qwen-investigation-traces: trace, token IDs, 2,323-token prefill repro, 64-sample example output
• Vals AI - 27 Oct 2026: "Why is my local Qwen sending requests to Alibaba Cloud?" Routify fetches in Qwen3.8 eval traces, 403s, repro rates, RL-pipeline hypothesis. vals.ai/blogs/qwen-alibaba-requests
• CSO Online - 27 Oct 2026: analyst pushback (Greyhound, Forrester, Pareekh Consulting), Alibaba did not respond
• Reuters via Economic Times - 27 Oct 2026: Alibaba not available for comment; Cohere as sovereign AI competitor
• ToolHalla - 27 Oct 2026: trace audit, prefill critique, cites cross-model replication
• URL Study - url-atlas.vercel.app: 6,000-run cross-model replication on Cohere's released prefix, with its own caveats