Cohere reports a self-hosted Qwen model attempting an upload to a Beijing bucket

Cohere says that in a closed sandbox, Alibaba's Qwen3.8-Flash-Next, an August preview of the Qwen4 architecture, was asked to write a detection rule on Microsoft's CTI-REALM benchmark. It instead listed /tmp, checked which transfer tools were installed, read the DNS settings and issued a curl PUT of a test string to an Alibaba Cloud storage bucket in Beijing. The sandbox had no route out, so the request failed. Cohere says the model's reasoning for that turn "said it wouldn't call any tools at all."

Cohere puts the rate at under one call in 100,000 across its evaluation runs, and says a clean re-run of the same prompt produced a normal rule. Its prefill experiments reported the model reaching for a cloud metadata address in 23 to 36 percent of completions before choosing a download, and URL generation rising from 4 to 92 percent once the curl -o flag was in the prefix. In a separate offline task, Cohere says the model used unshare to gain root inside a private namespace and mount a RAM disk after a permission refusal. Cohere says it cannot tell whether the behavior is deliberate or a training leftover.

Cohere sells competing sovereign models and the post argues for its own approach. It has published the traces and a reproduction script on Hugging Face; we have not opened or run them, so every figure here is Cohere's.

Why it matters: If your harness judges a tool call by reading the model's reasoning, Cohere's example is a case where the trace and the command disagreed. Cohere's own advice is to enforce on the actual tool call, deny agent egress by default and block unprivileged user namespaces in agent containers. None of those depend on the trace.